{"grype_matches":[{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-41993","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-41993","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-41993","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-41993","fix":{"state":"fixed","versions":["1.8.0_411","8.0.411"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_411"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.411"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-41993","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-41993","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-41993","date":"2026-11-02","epss":0.24349,"percentile":0.97866}],"risk":85.57500000000002,"urls":["https://security.gentoo.org/glsa/202401-33","https://security.netapp.com/advisory/ntap-20240426-0004/","https://support.apple.com/en-us/HT213940","https://support.apple.com/kb/HT213926","https://support.apple.com/kb/HT213930","https://webkitgtk.org/security/WSA-2023-0009.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-41993","description":"The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.","knownExploited":[{"cve":"CVE-2023-41993","cwes":["CWE-754"],"urls":["https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930","https://nvd.nist.gov/vuln/detail/CVE-2023-41993"],"dueDate":"2023-10-16","product":"Multiple Products","dateAdded":"2023-09-25","vendorProject":"Apple","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-42917","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-42917","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_411"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-42917","versionConstraint":"< 1.8.0_411||>= 1.9, < 8.0.411 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-42917","fix":{"state":"fixed","versions":["1.8.0_411","8.0.411"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_411"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.411"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-42917","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-42917","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-42917","date":"2026-11-02","epss":0.09295,"percentile":0.9537}],"risk":85.57500000000002,"urls":["http://seclists.org/fulldisclosure/2023/Dec/12","http://seclists.org/fulldisclosure/2023/Dec/13","http://seclists.org/fulldisclosure/2023/Dec/3","http://seclists.org/fulldisclosure/2023/Dec/4","http://seclists.org/fulldisclosure/2023/Dec/5","http://seclists.org/fulldisclosure/2023/Dec/8","http://seclists.org/fulldisclosure/2024/Jan/35","http://www.openwall.com/lists/oss-security/2023/12/05/1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/","https://security.gentoo.org/glsa/202401-04","https://support.apple.com/en-us/HT214031","https://support.apple.com/en-us/HT214032","https://support.apple.com/en-us/HT214033","https://support.apple.com/kb/HT214033","https://support.apple.com/kb/HT214034","https://support.apple.com/kb/HT214062","https://www.debian.org/security/2023/dsa-5575","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917","https://openjdk.org/groups/vulnerability/advisories/2024-04-16"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-42917","description":"A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.","knownExploited":[{"cve":"CVE-2023-42917","cwes":["CWE-787"],"urls":["https://support.apple.com/en-us/HT214031, https://support.apple.com/en-us/HT214032, https://support.apple.com/en-us/HT214033","https://nvd.nist.gov/vuln/detail/CVE-2023-42917"],"dueDate":"2023-12-25","product":"Multiple Products","dateAdded":"2023-12-04","vendorProject":"Apple","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"18.18.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-44487","versionConstraint":"< 18.18.2||>= 19, < 20.8.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-44487","fix":{"state":"fixed","versions":["18.18.2","20.8.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"18.18.2"},{"date":"2025-09-04","kind":"first-observed","version":"20.8.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-11-02","epss":0.99999,"percentile":0.99998}],"risk":78.75000000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12617","versionConstraint":"< 7.0.52-1ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12617","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.14"],"available":[{"date":"2018-05-30","kind":"advisory","version":"7.0.52-1ubuntu0.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12617","cwe":"CWE-434","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-12617","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-12617","date":"2026-11-02","epss":0.99968,"percentile":0.99977}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12617","knownExploited":[{"cve":"CVE-2017-12617","cwes":["CWE-434"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-12617"],"dueDate":"2022-04-15","product":"Tomcat","dateAdded":"2022-03-25","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2017-12617","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12617","cwe":"CWE-434","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-12617","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-12617","date":"2026-11-02","epss":0.99968,"percentile":0.99977}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/100954","http://www.securitytracker.com/id/1039552","https://access.redhat.com/errata/RHSA-2017:3080","https://access.redhat.com/errata/RHSA-2017:3081","https://access.redhat.com/errata/RHSA-2017:3113","https://access.redhat.com/errata/RHSA-2017:3114","https://access.redhat.com/errata/RHSA-2018:0268","https://access.redhat.com/errata/RHSA-2018:0269","https://access.redhat.com/errata/RHSA-2018:0270","https://access.redhat.com/errata/RHSA-2018:0271","https://access.redhat.com/errata/RHSA-2018:0275","https://access.redhat.com/errata/RHSA-2018:0465","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:2939","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html","https://security.netapp.com/advisory/ntap-20171018-0002/","https://security.netapp.com/advisory/ntap-20180117-0002/","https://support.f5.com/csp/article/K53173544","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://usn.ubuntu.com/3665-1/","https://www.exploit-db.com/exploits/42966/","https://www.exploit-db.com/exploits/43008/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","description":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","knownExploited":[{"cve":"CVE-2017-12617","cwes":["CWE-434"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-12617"],"dueDate":"2022-04-15","product":"Tomcat","dateAdded":"2022-03-25","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"2d3cdd73855dd6e7","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.4:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.4","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3156","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3156","date":"2026-11-02","epss":0.99962,"percentile":0.99976}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3156","knownExploited":[{"cve":"CVE-2021-3156","cwes":["CWE-122","CWE-193"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3156"],"dueDate":"2022-04-27","product":"Sudo","dateAdded":"2022-04-06","vendorProject":"Sudo","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2021-3156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3156","date":"2026-11-02","epss":0.99962,"percentile":0.99976}],"urls":["http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html","http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html","http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html","http://seclists.org/fulldisclosure/2021/Feb/42","http://seclists.org/fulldisclosure/2021/Jan/79","http://seclists.org/fulldisclosure/2024/Feb/3","http://www.openwall.com/lists/oss-security/2021/01/26/3","http://www.openwall.com/lists/oss-security/2021/01/27/1","http://www.openwall.com/lists/oss-security/2021/01/27/2","http://www.openwall.com/lists/oss-security/2021/02/15/1","http://www.openwall.com/lists/oss-security/2021/09/14/2","http://www.openwall.com/lists/oss-security/2024/01/30/6","http://www.openwall.com/lists/oss-security/2024/01/30/8","https://kc.mcafee.com/corporate/index?page=content&id=SB10348","https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/","https://security.gentoo.org/glsa/202101-33","https://security.netapp.com/advisory/ntap-20210128-0001/","https://security.netapp.com/advisory/ntap-20210128-0002/","https://support.apple.com/kb/HT212177","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM","https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability","https://www.debian.org/security/2021/dsa-4839","https://www.kb.cert.org/vuls/id/794544","https://www.openwall.com/lists/oss-security/2021/01/26/3","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.sudo.ws/stable.html#1.9.5p2","https://www.synology.com/security/advisory/Synology_SA_21_02","https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3156","description":"Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","knownExploited":[{"cve":"CVE-2021-3156","cwes":["CWE-122","CWE-193"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3156"],"dueDate":"2022-04-27","product":"Sudo","dateAdded":"2022-04-06","vendorProject":"Sudo","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"5699f089c9edef9d","cpes":["cpe:2.3:a:libcommons-collections3-java:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3-java:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3_java:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3_java:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*"],"name":"libcommons-collections3-java","purl":"pkg:deb/ubuntu/libcommons-collections3-java@3.2.1-6?arch=all&distro=ubuntu-14.04","type":"deb","version":"3.2.1-6","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcommons-collections3-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libcommons-collections3-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-collections3-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-collections3-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-collections3-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-collections3-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-4852","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libcommons-collections3-java","version":"3.2.1-6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-4852","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-4852","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2015-4852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"urls":["http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2015/11/17/19","http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.securityfocus.com/bid/77539","http://www.securitytracker.com/id/1038292","https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","https://www.exploit-db.com/exploits/42806/","https://www.exploit-db.com/exploits/46628/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-4852","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-4852","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-4852","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2015-4852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"urls":["http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2015/11/17/19","http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.securityfocus.com/bid/77539","http://www.securitytracker.com/id/1038292","https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","https://www.exploit-db.com/exploits/42806/","https://www.exploit-db.com/exploits/46628/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-4852","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-4852","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-4852","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2015-4852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4852","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4852","date":"2026-11-02","epss":0.94991,"percentile":0.99861}],"urls":["http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2015/11/17/19","http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.securityfocus.com/bid/77539","http://www.securitytracker.com/id/1038292","https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","https://www.exploit-db.com/exploits/42806/","https://www.exploit-db.com/exploits/46628/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-4852","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","knownExploited":[{"cve":"CVE-2015-4852","cwes":["CWE-502"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-4852"],"dueDate":"2022-05-03","product":"WebLogic Server","dateAdded":"2021-11-03","vendorProject":"Oracle","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8735","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8735","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2016-8735","date":"2026-11-02","epss":0.90338,"percentile":0.99798}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8735","knownExploited":[{"cve":"CVE-2016-8735","cwes":["CWE-284"],"urls":["https://tomcat.apache.org/security-9.html","https://nvd.nist.gov/vuln/detail/CVE-2016-8735"],"dueDate":"2023-06-02","product":"Tomcat","dateAdded":"2023-05-12","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2016-8735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-8735","date":"2026-11-02","epss":0.90338,"percentile":0.99798}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://seclists.org/oss-sec/2016/q4/502","http://svn.apache.org/viewvc?view=revision&revision=1767644","http://svn.apache.org/viewvc?view=revision&revision=1767656","http://svn.apache.org/viewvc?view=revision&revision=1767676","http://svn.apache.org/viewvc?view=revision&revision=1767684","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3738","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94463","http://www.securitytracker.com/id/1037331","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180607-0001/","https://usn.ubuntu.com/4557-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8735","description":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","knownExploited":[{"cve":"CVE-2016-8735","cwes":["CWE-284"],"urls":["https://tomcat.apache.org/security-9.html","https://nvd.nist.gov/vuln/detail/CVE-2016-8735"],"dueDate":"2023-06-02","product":"Tomcat","dateAdded":"2023-05-12","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"52c8890d58157104","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.5.2-1ubuntu2.8:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/ubuntu/libfreetype6@2.5.2-1ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=freetype","type":"deb","version":"2.5.2-1ubuntu2.8","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","Catharon-OSL","FTL","GPL-2","GPL-2+","GZip","OpenGroup-BSD-like"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"freetype","version":"2.5.2-1ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-15999","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15999","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15999","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15999","date":"2026-11-02","epss":0.63894,"percentile":0.99223}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15999","knownExploited":[{"cve":"CVE-2020-15999","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-15999"],"dueDate":"2021-11-17","product":"Chrome FreeType","dateAdded":"2021-11-03","vendorProject":"Google","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2020-15999","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15999","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15999","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15999","date":"2026-11-02","epss":0.63894,"percentile":0.99223}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html","http://seclists.org/fulldisclosure/2020/Nov/33","https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html","https://crbug.com/1139963","https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/","https://security.gentoo.org/glsa/202011-12","https://security.gentoo.org/glsa/202012-04","https://security.gentoo.org/glsa/202401-19","https://www.debian.org/security/2021/dsa-4824","https://security.netapp.com/advisory/ntap-20240812-0001/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15999","description":"Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","knownExploited":[{"cve":"CVE-2020-15999","cwes":["CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-15999"],"dueDate":"2021-11-17","product":"Chrome FreeType","dateAdded":"2021-11-03","vendorProject":"Google","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"18.20.1"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-27983","versionConstraint":"< 18.20.1||>= 19, < 20.12.1||>= 21, < 21.7.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-27983","fix":{"state":"fixed","versions":["18.20.1","20.12.1","21.7.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"18.20.1"},{"date":"2025-09-04","kind":"first-observed","version":"20.12.1"},{"date":"2025-09-04","kind":"first-observed","version":"21.7.2"}]},"cvss":[{"type":"Secondary","source":"support@hackerone.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-27983","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-27983","date":"2026-11-02","epss":0.87211,"percentile":0.99751}],"risk":68.460635,"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","https://hackerone.com/reports/2319584","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/","https://security.netapp.com/advisory/ntap-20240510-0002/","https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html","https://www.kb.cert.org/vuls/id/421644","https://github.com/nodejs/node/releases/tag/v18.20.1","https://github.com/nodejs/node/releases/tag/v20.12.1","https://github.com/nodejs/node/releases/tag/v21.7.2"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-27983","description":"An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-2183","versionConstraint":">= 4.2.0, < 4.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2183","fix":{"state":"fixed","versions":["4.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2183","date":"2026-11-02","epss":0.94697,"percentile":0.99857}],"risk":67.07704166666667,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2017-0336.html","http://rhn.redhat.com/errata/RHSA-2017-0337.html","http://rhn.redhat.com/errata/RHSA-2017-0338.html","http://rhn.redhat.com/errata/RHSA-2017-0462.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://seclists.org/fulldisclosure/2017/May/105","http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697","http://www-01.ibm.com/support/docview.wss?uid=swg21991482","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/542005/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded","http://www.securityfocus.com/bid/92630","http://www.securityfocus.com/bid/95568","http://www.securitytracker.com/id/1036696","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3179-1","http://www.ubuntu.com/usn/USN-3194-1","http://www.ubuntu.com/usn/USN-3198-1","http://www.ubuntu.com/usn/USN-3270-1","http://www.ubuntu.com/usn/USN-3372-1","https://access.redhat.com/articles/2548661","https://access.redhat.com/errata/RHSA-2017:1216","https://access.redhat.com/errata/RHSA-2017:2708","https://access.redhat.com/errata/RHSA-2017:2709","https://access.redhat.com/errata/RHSA-2017:2710","https://access.redhat.com/errata/RHSA-2017:3113","https://access.redhat.com/errata/RHSA-2017:3114","https://access.redhat.com/errata/RHSA-2017:3239","https://access.redhat.com/errata/RHSA-2017:3240","https://access.redhat.com/errata/RHSA-2018:2123","https://access.redhat.com/errata/RHSA-2019:1245","https://access.redhat.com/errata/RHSA-2019:2859","https://access.redhat.com/errata/RHSA-2020:0451","https://access.redhat.com/security/cve/cve-2016-2183","https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/","https://bto.bluecoat.com/security-advisory/sa133","https://bugzilla.redhat.com/show_bug.cgi?id=1369383","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10186","https://kc.mcafee.com/corporate/index?page=content&id=SB10197","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://kc.mcafee.com/corporate/index?page=content&id=SB10310","https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://seclists.org/bugtraq/2018/Nov/21","https://security.gentoo.org/glsa/201612-16","https://security.gentoo.org/glsa/201701-65","https://security.gentoo.org/glsa/201707-01","https://security.netapp.com/advisory/ntap-20160915-0001/","https://security.netapp.com/advisory/ntap-20170119-0001/","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178","https://support.f5.com/csp/article/K13167034","https://sweet32.info/","https://wiki.opendaylight.org/view/Security_Advisories","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.exploit-db.com/exploits/42091/","https://www.ietf.org/mail-archive/web/tls/current/msg04560.html","https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008","https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/","https://www.openssl.org/blog/blog/2016/08/24/sweet32/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.sigsac.org/ccs/CCS2016/accepted-papers/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21","https://www.tenable.com/security/tns-2017-09","https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue","https://www.vicarius.io/vsociety/posts/cve-2016-2183-detection-sweet32-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2016-2183-mitigate-sweet32-vulnerability"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2183","description":"The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.9.v20150224"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ghgj-3xqr-6jfm","versionConstraint":"<=9.2.8.v20150217 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ghgj-3xqr-6jfm","fix":{"state":"fixed","versions":["9.2.9.v20150224"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.2.9.v20150224"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2080","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2080","date":"2026-11-02","epss":0.75441,"percentile":0.99516}],"risk":56.58075,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-2080","https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html","https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md","https://security.netapp.com/advisory/ntap-20190307-0005/","http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html","http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html","http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html","http://seclists.org/fulldisclosure/2015/Mar/12","http://www.securityfocus.com/archive/1/534755/100/1600/threaded","http://www.securityfocus.com/bid/72768","http://www.securitytracker.com/id/1031800"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ghgj-3xqr-6jfm","description":"Jetty vulnerable to exposure of sensitive information to unauthenticated remote users"},"relatedVulnerabilities":[{"id":"CVE-2015-2080","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2080","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2080","date":"2026-11-02","epss":0.75441,"percentile":0.99516}],"urls":["http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html","http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html","http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html","http://seclists.org/fulldisclosure/2015/Mar/12","http://www.securityfocus.com/archive/1/534755/100/1600/threaded","http://www.securityfocus.com/bid/72768","http://www.securitytracker.com/id/1031800","https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html","https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md","https://security.netapp.com/advisory/ntap-20190307-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2080","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-11-02","epss":0.73188,"percentile":0.99457}],"risk":54.891,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0778"},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-11-02","epss":0.73188,"percentile":0.99457}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-11-02","epss":0.73188,"percentile":0.99457}],"risk":54.891,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0778"},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-11-02","epss":0.73188,"percentile":0.99457}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-11-02","epss":0.69286,"percentile":0.99358}],"risk":51.9645,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-0286"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-11-02","epss":0.69286,"percentile":0.99358}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-203374.html","https://cert-portal.siemens.com/productcert/html/ssa-264815.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-455250.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-11-02","epss":0.69286,"percentile":0.99358}],"risk":51.9645,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-0286"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-11-02","epss":0.69286,"percentile":0.99358}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-203374.html","https://cert-portal.siemens.com/productcert/html/ssa-264815.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-455250.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"fcac84f1a59528a1","cpes":["cpe:2.3:a:libyaml-snake-java:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake-java:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake_java:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake_java:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*"],"name":"libyaml-snake-java","purl":"pkg:deb/ubuntu/libyaml-snake-java@1.12-2?arch=all&distro=ubuntu-14.04&upstream=snakeyaml","type":"deb","version":"1.12-2","language":"","licenses":["Apache-2.0","BSD","EPL-1.0","GPL-2","LGPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libyaml-snake-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libyaml-snake-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libyaml-snake-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libyaml-snake-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libyaml-snake-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libyaml-snake-java.list"}],"upstreams":[{"name":"snakeyaml"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"snakeyaml","version":"1.12-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-1471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1471","cwe":"CWE-20","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2022-1471","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1471","date":"2026-11-02","epss":0.99501,"percentile":0.99946}],"risk":49.750499999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-1471"},"relatedVulnerabilities":[{"id":"CVE-2022-1471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1471","cwe":"CWE-20","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2022-1471","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1471","date":"2026-11-02","epss":0.99501,"percentile":0.99946}],"urls":["http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/11/19/1","https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479","https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html","https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2","https://github.com/mbechler/marshalsec","https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc","https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c","https://security.netapp.com/advisory/ntap-20230818-0015/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471","description":"SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond."}]},{"artifact":{"id":"4b585ce20b0b290d","cpes":["cpe:2.3:a:libcommons-beanutils-java:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils-java:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils_java:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils_java:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*"],"name":"libcommons-beanutils-java","purl":"pkg:deb/ubuntu/libcommons-beanutils-java@1.9.1-1?arch=all&distro=ubuntu-14.04&upstream=commons-beanutils","type":"deb","version":"1.9.1-1","language":"","licenses":["sha256:a0ea7d5d98f51289cfff265531219586cb2bfda54a9097301d781d531d522146"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcommons-beanutils-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libcommons-beanutils-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-beanutils-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-beanutils-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-beanutils-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-beanutils-java.list"}],"upstreams":[{"name":"commons-beanutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"commons-beanutils","version":"1.9.1-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0114","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-0114","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0114","date":"2026-11-02","epss":0.99032,"percentile":0.99931}],"risk":49.516,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0114"},"relatedVulnerabilities":[{"id":"CVE-2014-0114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0114","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0114","date":"2026-11-02","epss":0.99032,"percentile":0.99931}],"urls":["http://advisories.mageia.org/MGASA-2014-0219.html","http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html","http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt","http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html","http://marc.info/?l=bugtraq&m=140119284401582&w=2","http://marc.info/?l=bugtraq&m=140801096002766&w=2","http://marc.info/?l=bugtraq&m=141451023707502&w=2","http://openwall.com/lists/oss-security/2014/06/15/10","http://openwall.com/lists/oss-security/2014/07/08/1","http://seclists.org/fulldisclosure/2014/Dec/23","http://secunia.com/advisories/57477","http://secunia.com/advisories/58710","http://secunia.com/advisories/58851","http://secunia.com/advisories/58947","http://secunia.com/advisories/59014","http://secunia.com/advisories/59118","http://secunia.com/advisories/59228","http://secunia.com/advisories/59245","http://secunia.com/advisories/59246","http://secunia.com/advisories/59430","http://secunia.com/advisories/59464","http://secunia.com/advisories/59479","http://secunia.com/advisories/59480","http://secunia.com/advisories/59704","http://secunia.com/advisories/59718","http://secunia.com/advisories/60177","http://secunia.com/advisories/60703","http://www-01.ibm.com/support/docview.wss?uid=swg21674128","http://www-01.ibm.com/support/docview.wss?uid=swg21674812","http://www-01.ibm.com/support/docview.wss?uid=swg21675266","http://www-01.ibm.com/support/docview.wss?uid=swg21675387","http://www-01.ibm.com/support/docview.wss?uid=swg21675689","http://www-01.ibm.com/support/docview.wss?uid=swg21675898","http://www-01.ibm.com/support/docview.wss?uid=swg21675972","http://www-01.ibm.com/support/docview.wss?uid=swg21676091","http://www-01.ibm.com/support/docview.wss?uid=swg21676110","http://www-01.ibm.com/support/docview.wss?uid=swg21676303","http://www-01.ibm.com/support/docview.wss?uid=swg21676375","http://www-01.ibm.com/support/docview.wss?uid=swg21676931","http://www-01.ibm.com/support/docview.wss?uid=swg21677110","http://www-01.ibm.com/support/docview.wss?uid=swg27042296","http://www.debian.org/security/2014/dsa-2940","http://www.ibm.com/support/docview.wss?uid=swg21675496","http://www.mandriva.com/security/advisories?name=MDVSA-2014:095","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","http://www.securityfocus.com/archive/1/534161/100/0/threaded","http://www.securityfocus.com/bid/67121","http://www.vmware.com/security/advisories/VMSA-2014-0008.html","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:2995","https://access.redhat.com/solutions/869353","https://bugzilla.redhat.com/show_bug.cgi?id=1091938","https://bugzilla.redhat.com/show_bug.cgi?id=1116665","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","https://issues.apache.org/jira/browse/BEANUTILS-463","https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40%40%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/r458d61eaeadecaad04382ebe583230bc027f48d9e85e4731bc573477%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","https://security.gentoo.org/glsa/201607-09","https://security.netapp.com/advisory/ntap-20140911-0001/","https://security.netapp.com/advisory/ntap-20180629-0006/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11784","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11784","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11784","date":"2026-11-02","epss":0.9768,"percentile":0.99903}],"risk":48.84,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11784"},"relatedVulnerabilities":[{"id":"CVE-2018-11784","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11784","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11784","date":"2026-11-02","epss":0.9768,"percentile":0.99903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html","http://www.securityfocus.com/bid/105524","https://access.redhat.com/errata/RHSA-2019:0130","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0485","https://access.redhat.com/errata/RHSA-2019:1529","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","https://seclists.org/bugtraq/2019/Dec/43","https://security.netapp.com/advisory/ntap-20181014-0002/","https://usn.ubuntu.com/3787-1/","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11784","description":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11784","versionConstraint":"< 7.0.52-1ubuntu0.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11784","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.16"],"available":[{"date":"2018-10-10","kind":"advisory","version":"7.0.52-1ubuntu0.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11784","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11784","date":"2026-11-02","epss":0.9768,"percentile":0.99903}],"risk":48.84,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11784"},"relatedVulnerabilities":[{"id":"CVE-2018-11784","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11784","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11784","date":"2026-11-02","epss":0.9768,"percentile":0.99903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html","http://www.securityfocus.com/bid/105524","https://access.redhat.com/errata/RHSA-2019:0130","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0485","https://access.redhat.com/errata/RHSA-2019:1529","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","https://seclists.org/bugtraq/2019/Dec/43","https://security.netapp.com/advisory/ntap-20181014-0002/","https://usn.ubuntu.com/3787-1/","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11784","description":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.9.1-1ubuntu0.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:1.9.1-1ubuntu0.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:1.9.1-1ubuntu0.9"],"available":[{"date":"2018-10-12","kind":"advisory","version":"1:1.9.1-1ubuntu0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-11-02","epss":0.97356,"percentile":0.99898}],"risk":48.678,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-11-02","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.9.1-1ubuntu0.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:1.9.1-1ubuntu0.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:1.9.1-1ubuntu0.9"],"available":[{"date":"2018-10-12","kind":"advisory","version":"1:1.9.1-1ubuntu0.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-11-02","epss":0.97356,"percentile":0.99898}],"risk":48.678,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-11-02","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-11-02","epss":0.96391,"percentile":0.9988}],"risk":48.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2068"},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-11-02","epss":0.96391,"percentile":0.9988}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis","https://cert-portal.siemens.com/productcert/html/ssa-146325.html","https://cert-portal.siemens.com/productcert/html/ssa-332410.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-11-02","epss":0.96391,"percentile":0.9988}],"risk":48.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2068"},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-11-02","epss":0.96391,"percentile":0.9988}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis","https://cert-portal.siemens.com/productcert/html/ssa-146325.html","https://cert-portal.siemens.com/productcert/html/ssa-332410.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"],"vulnerabilityID":"CVE-2016-6304","versionConstraint":">= 0.10.0, < 0.10.47||>= 0.12.0, < 0.12.16||>= 4.0.0, < 4.6.0||>= 6.0.0, < 6.7.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-6304","fix":{"state":"fixed","versions":["0.10.47","0.12.16","4.6.0","6.7.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"0.10.47"},{"date":"2025-09-04","kind":"first-observed","version":"0.12.16"},{"date":"2025-09-04","kind":"first-observed","version":"4.6.0"},{"date":"2025-09-04","kind":"first-observed","version":"6.7.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-11-02","epss":0.63029,"percentile":0.992}],"risk":47.744467500000006,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2802.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2016/Dec/47","http://seclists.org/fulldisclosure/2016/Oct/62","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93150","http://www.securitytracker.com/id/1036878","http://www.securitytracker.com/id/1037640","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","description":"Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions."},"relatedVulnerabilities":[]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-48795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-48795","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-11-02","epss":0.93547,"percentile":0.9984}],"risk":46.7735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-48795"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-11-02","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-21300","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-21300","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21300","date":"2026-11-02","epss":0.88533,"percentile":0.99772}],"risk":44.2665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-21300"},"relatedVulnerabilities":[{"id":"CVE-2021-21300","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8,"impactScore":5.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21300","date":"2026-11-02","epss":0.88533,"percentile":0.99772}],"urls":["http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html","http://seclists.org/fulldisclosure/2021/Apr/60","http://www.openwall.com/lists/oss-security/2021/03/09/3","https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks","https://git-scm.com/docs/gitattributes#_filter","https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592","https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm","https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/","https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202104-01","https://support.apple.com/kb/HT212320"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21300","description":"Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-21300","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-21300","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21300","date":"2026-11-02","epss":0.88533,"percentile":0.99772}],"risk":44.2665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-21300"},"relatedVulnerabilities":[{"id":"CVE-2021-21300","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8,"impactScore":5.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21300","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21300","date":"2026-11-02","epss":0.88533,"percentile":0.99772}],"urls":["http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html","http://seclists.org/fulldisclosure/2021/Apr/60","http://www.openwall.com/lists/oss-security/2021/03/09/3","https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks","https://git-scm.com/docs/gitattributes#_filter","https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592","https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm","https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/","https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202104-01","https://support.apple.com/kb/HT212320"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21300","description":"Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6."}]},{"artifact":{"id":"a6fcde16b943ffcb","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"eca63cdd4d65e2ef","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"a962637344871aaa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"1a80ece3627ef154","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"556cca2eb09fbcff","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-11-02","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13935","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-13935","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13935","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13935","date":"2026-11-02","epss":0.86608,"percentile":0.99739}],"risk":43.303999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-13935"},"relatedVulnerabilities":[{"id":"CVE-2020-13935","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13935","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13935","date":"2026-11-02","epss":0.86608,"percentile":0.99739}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10332","https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","https://security.netapp.com/advisory/ntap-20200724-0003/","https://usn.ubuntu.com/4448-1/","https://usn.ubuntu.com/4596-1/","https://www.debian.org/security/2020/dsa-4727","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13935","description":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-11-02","epss":0.84994,"percentile":0.99712}],"risk":42.497,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36221"},"relatedVulnerabilities":[{"id":"CVE-2020-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-11-02","epss":0.84994,"percentile":0.99712}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9404","https://bugs.openldap.org/show_bug.cgi?id=9424","https://git.openldap.org/openldap/openldap/-/commit/38ac838e4150c626bbfa0082b7e2cf3a2bb4df31","https://git.openldap.org/openldap/openldap/-/commit/58c1748e81c843c5b6e61648d2a4d1d82b47e842","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-11-02","epss":0.84994,"percentile":0.99712}],"risk":42.497,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36228"},"relatedVulnerabilities":[{"id":"CVE-2020-36228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-11-02","epss":0.84994,"percentile":0.99712}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9427","https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-11-02","epss":0.82612,"percentile":0.99666}],"risk":41.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-1292"},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-11-02","epss":0.82612,"percentile":0.99666}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis","https://cert-portal.siemens.com/productcert/html/ssa-146325.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html","https://cert-portal.siemens.com/productcert/html/ssa-953464.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-11-02","epss":0.82612,"percentile":0.99666}],"risk":41.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-1292"},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-11-02","epss":0.82612,"percentile":0.99666}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis","https://cert-portal.siemens.com/productcert/html/ssa-146325.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html","https://cert-portal.siemens.com/productcert/html/ssa-953464.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.4.4"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-2107","versionConstraint":">= 4.2.0, < 4.4.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2107","fix":{"state":"fixed","versions":["4.4.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.4.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2107","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2107","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2107","date":"2026-11-02","epss":0.89058,"percentile":0.99779}],"risk":41.189325000000004,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html","http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html","http://rhn.redhat.com/errata/RHSA-2016-0722.html","http://rhn.redhat.com/errata/RHSA-2016-0996.html","http://rhn.redhat.com/errata/RHSA-2016-2073.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://source.android.com/security/bulletin/2016-07-01.html","http://support.citrix.com/article/CTX212736","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl","http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html","http://www.debian.org/security/2016/dsa-3566","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/89760","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1035721","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103","http://www.ubuntu.com/usn/USN-2959-1","https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/","https://bto.bluecoat.com/security-advisory/sa123","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88afb6c292","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202","https://kc.mcafee.com/corporate/index?page=content&id=SB10160","https://security.gentoo.org/glsa/201612-16","https://security.netapp.com/advisory/ntap-20160504-0001/","https://support.apple.com/HT206903","https://www.exploit-db.com/exploits/39768/","https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc","https://www.openssl.org/news/secadv/20160503.txt","https://www.tenable.com/security/tns-2016-18"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2107","description":"The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169."},"relatedVulnerabilities":[]},{"artifact":{"id":"6ce5156012ed5c7a","cpes":["cpe:2.3:a:libxalan2-java:libxalan2-java:2.7.1-9:*:*:*:*:*:*:*","cpe:2.3:a:libxalan2-java:libxalan2_java:2.7.1-9:*:*:*:*:*:*:*","cpe:2.3:a:libxalan2_java:libxalan2-java:2.7.1-9:*:*:*:*:*:*:*","cpe:2.3:a:libxalan2_java:libxalan2_java:2.7.1-9:*:*:*:*:*:*:*","cpe:2.3:a:libxalan2:libxalan2-java:2.7.1-9:*:*:*:*:*:*:*","cpe:2.3:a:libxalan2:libxalan2_java:2.7.1-9:*:*:*:*:*:*:*"],"name":"libxalan2-java","purl":"pkg:deb/ubuntu/libxalan2-java@2.7.1-9?arch=all&distro=ubuntu-14.04","type":"deb","version":"2.7.1-9","language":"","licenses":["sha256:beb8253acbfb1a5ab631a437c83e1375eae7e26a926164cb38bb0da332f93b41"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxalan2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libxalan2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxalan2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxalan2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxalan2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxalan2-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-34169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxalan2-java","version":"2.7.1-9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-34169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-34169","date":"2026-11-02","epss":0.81759,"percentile":0.99644}],"risk":40.8795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-34169"},"relatedVulnerabilities":[{"id":"CVE-2022-34169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-34169","date":"2026-11-02","epss":0.81759,"percentile":0.99644}],"urls":["http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html","http://www.openwall.com/lists/oss-security/2022/07/19/5","http://www.openwall.com/lists/oss-security/2022/07/19/6","http://www.openwall.com/lists/oss-security/2022/07/20/2","http://www.openwall.com/lists/oss-security/2022/07/20/3","http://www.openwall.com/lists/oss-security/2022/10/18/2","http://www.openwall.com/lists/oss-security/2022/11/04/8","http://www.openwall.com/lists/oss-security/2022/11/07/2","https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw","https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8","https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/","https://security.gentoo.org/glsa/202401-25","https://security.netapp.com/advisory/ntap-20220729-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2022/dsa-5188","https://www.debian.org/security/2022/dsa-5192","https://www.debian.org/security/2022/dsa-5256","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","description":"The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan."}]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.4.39"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-26vr-8j45-3r4w","versionConstraint":">=7.2.2,<9.4.39 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-26vr-8j45-3r4w","fix":{"state":"fixed","versions":["9.4.39"],"available":[{"date":"2023-09-27","kind":"first-observed","version":"9.4.39"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28165","cwe":"CWE-400","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28165","cwe":"CWE-551","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28165","cwe":"CWE-755","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28165","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28165","date":"2026-11-02","epss":0.53861,"percentile":0.99001}],"risk":40.39575,"urls":["https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w","https://nvd.nist.gov/vuln/detail/CVE-2021-28165","https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e66970eafd54f9c3e2@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced7641b92a22a783287@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a4d55b3b4b8891becb@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c1b1ada3920b01e959@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3dd4f2a024c1e43b94@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d95669b3afbf6efa36@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76f232277446ae0948a@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31375bc42a0dcc964b2@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf8e3fb37fcf33b2cd0@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04a2edcd23761894464@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e2e64992137f4dc63d@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aac1a47551f0dc55486@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970dc1bc5cd214b711f77@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f15a8c4212fad89d9f@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea9931c9b19709b87f292b@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df68bf9334736107a6e@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31b800bf37f01473ad7@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711cbf334e2913332730a@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a8b928916ef65dd2ad@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47da164002bf2baffe5@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c1fab8203ebd212add@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35bec149c0cc247579c42@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5cb2e7fd0c9a78f97c4@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865ea1e891572d15faa6@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d668a9497c999946cd78@%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd8be6ac4d6aea4f0cf@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee2361bf01549f9e3440ca@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880ddf28a796f09ce152@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b6e6d2c2a423f8baee@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db4805ea4a998d4c225@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae915100099c4391ad64e9ae38b@%3Cdev.hbase.apache.org%3E","https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91acc646607cbc0a4da@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d5994d08507a2e5477c9@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f28543252e887ca03bd5621e@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda3987084595192e3845d@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587fd5939fe8be09907c7@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c139021f40a5774090@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c71ecc720b8ecf281f0@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e3131322be9c07a1da@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f07294959d60fea1bd76f7d81@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc593394d144755824da@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350e8589269a72fd7913@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c7755029e944dfee31b8b779@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb4bebb2416da638424@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7fe561bb7e036e8449@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd116d2170a3eed9f5c@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c2536b00c56738beef@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea3776b911e024fa3b187@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1edccd56fa9fb7a547f2@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d586ae1f9f505a311c@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2aeefb7f96fe348537b@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d5054cc34561cb89b81af@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc457975fc0445ac97f@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55d025666fe41099f33@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036cb67987ad42c1f2dce@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa8a85b10a73403ee97@%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f201b77e1afcf774e7a6@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a6172117d62b8e57596aa@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044ccb37a30768938f7e@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da624250c559999eaeb@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68ef5f6839ffca9c1c1@%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c19958196354b39568c532f26@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c1a3d89933173deed6@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed7d506be9357a3a7ec@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719d2f83a41e8faf295f@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b2e142e3e1c6774743@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf669d6f7da59ef1eb155@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a6999560212e519b5f09db0aed@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391cf94ec4e1f4537ae3@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135a1a2f45786417adb7@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c469175410777a78d812@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1de49dc7fd04cad1ebc@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c24477e7b1ac9be076a825@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf629425418c2b69bb16745f@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002da0ddac5ad851ae7e7@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b@%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340c798dfcb55cb7acc7@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5e15023de29ebd4f9f@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb353604dd2f765c9da5df7@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d631cf54899082058ef1@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11af66e7ec72128d020@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd136739089c3231658e398cf38@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e@%3Cdev.ignite.apache.org%3E","https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b2d57a2bdb0341536e@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961@%3Cissues.solr.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/04/20/3","https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f@%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46@%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd@%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b72af9f9410cffbe35@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad0642db8c936e4f0b7@%3Creviews.spark.apache.org%3E","https://security.netapp.com/advisory/ntap-20210611-0006/","https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f525c232ec5b8eb83a@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c@%3Cissues.solr.apache.org%3E","https://www.debian.org/security/2021/dsa-4949","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-26vr-8j45-3r4w","description":"Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources"},"relatedVulnerabilities":[{"id":"CVE-2021-28165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28165","cwe":"CWE-400","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28165","cwe":"CWE-551","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28165","cwe":"CWE-755","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28165","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28165","date":"2026-11-02","epss":0.53861,"percentile":0.99001}],"urls":["http://www.openwall.com/lists/oss-security/2021/04/20/3","https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w","https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711cbf334e2913332730a%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a8b928916ef65dd2ad%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47da164002bf2baffe5%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002da0ddac5ad851ae7e7%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e66970eafd54f9c3e2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c1fab8203ebd212add%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391cf94ec4e1f4537ae3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35bec149c0cc247579c42%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5cb2e7fd0c9a78f97c4%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced7641b92a22a783287%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865ea1e891572d15faa6%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d668a9497c999946cd78%40%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd8be6ac4d6aea4f0cf%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee2361bf01549f9e3440ca%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a4d55b3b4b8891becb%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f525c232ec5b8eb83a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b72af9f9410cffbe35%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880ddf28a796f09ce152%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b6e6d2c2a423f8baee%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db4805ea4a998d4c225%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae915100099c4391ad64e9ae38b%40%3Cdev.hbase.apache.org%3E","https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf669d6f7da59ef1eb155%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c1b1ada3920b01e959%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91acc646607cbc0a4da%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3dd4f2a024c1e43b94%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad0642db8c936e4f0b7%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135a1a2f45786417adb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c469175410777a78d812%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340c798dfcb55cb7acc7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3E","https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5e15023de29ebd4f9f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d5994d08507a2e5477c9%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb353604dd2f765c9da5df7%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f28543252e887ca03bd5621e%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda3987084595192e3845d%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587fd5939fe8be09907c7%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c139021f40a5774090%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c71ecc720b8ecf281f0%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d95669b3afbf6efa36%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e3131322be9c07a1da%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d631cf54899082058ef1%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f07294959d60fea1bd76f7d81%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1de49dc7fd04cad1ebc%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc593394d144755824da%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350e8589269a72fd7913%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c7755029e944dfee31b8b779%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb4bebb2416da638424%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76f232277446ae0948a%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31375bc42a0dcc964b2%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7fe561bb7e036e8449%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf8e3fb37fcf33b2cd0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd116d2170a3eed9f5c%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c2536b00c56738beef%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea3776b911e024fa3b187%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04a2edcd23761894464%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1edccd56fa9fb7a547f2%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d586ae1f9f505a311c%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2aeefb7f96fe348537b%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d5054cc34561cb89b81af%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc457975fc0445ac97f%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e2e64992137f4dc63d%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aac1a47551f0dc55486%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55d025666fe41099f33%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c24477e7b1ac9be076a825%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11af66e7ec72128d020%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036cb67987ad42c1f2dce%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970dc1bc5cd214b711f77%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf629425418c2b69bb16745f%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa8a85b10a73403ee97%40%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f201b77e1afcf774e7a6%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd136739089c3231658e398cf38%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3E","https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b2d57a2bdb0341536e%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a6172117d62b8e57596aa%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044ccb37a30768938f7e%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f15a8c4212fad89d9f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da624250c559999eaeb%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68ef5f6839ffca9c1c1%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c19958196354b39568c532f26%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea9931c9b19709b87f292b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df68bf9334736107a6e%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c1a3d89933173deed6%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed7d506be9357a3a7ec%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719d2f83a41e8faf295f%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31b800bf37f01473ad7%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a6999560212e519b5f09db0aed%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b2e142e3e1c6774743%40%3Creviews.spark.apache.org%3E","https://security.netapp.com/advisory/ntap-20210611-0006/","https://www.debian.org/security/2021/dsa-4949","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28165","description":"In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame."}]},{"artifact":{"id":"9a970c6653efeee4","cpes":["cpe:2.3:a:liblog4j1.2-java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2-java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*"],"name":"liblog4j1.2-java","purl":"pkg:deb/ubuntu/liblog4j1.2-java@1.2.17-4ubuntu3?arch=all&distro=ubuntu-14.04&upstream=apache-log4j1.2","type":"deb","version":"1.2.17-4ubuntu3","language":"","licenses":["sha256:b3bb57eaee4814882ed5ab7c94583073fe8eb9d3082703169252c446a8250047"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblog4j1.2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/liblog4j1.2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.list"}],"upstreams":[{"name":"apache-log4j1.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-4104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apache-log4j1.2","version":"1.2.17-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-4104","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4104","date":"2026-11-02","epss":0.80599,"percentile":0.99625}],"risk":40.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-4104"},"relatedVulnerabilities":[{"id":"CVE-2021-4104","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4104","date":"2026-11-02","epss":0.80599,"percentile":0.99625}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/3","https://access.redhat.com/security/cve/CVE-2021-4104","https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202310-16","https://security.gentoo.org/glsa/202312-02","https://security.gentoo.org/glsa/202312-04","https://security.netapp.com/advisory/ntap-20211223-0007/","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4104","description":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-38408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-38408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-11-02","epss":0.797,"percentile":0.99606}],"risk":39.85,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-38408"},"relatedVulnerabilities":[{"id":"CVE-2023-38408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-11-02","epss":0.797,"percentile":0.99606}],"urls":["http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.openwall.com/lists/oss-security/2023/07/20/2","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","https://news.ycombinator.com/item?id=36790196","https://security.gentoo.org/glsa/202307-01","https://security.netapp.com/advisory/ntap-20230803-0010/","https://support.apple.com/kb/HT213940","https://www.openssh.com/security.html","https://www.openssh.com/txt/release-9.3p2","https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38408","description":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2017-3731","versionConstraint":">= 4.2.0, < 4.7.3||>= 6.9.0, < 6.9.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-3731","fix":{"state":"fixed","versions":["4.7.3","6.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.7.3"},{"date":"2025-09-04","kind":"first-observed","version":"6.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-11-02","epss":0.57322,"percentile":0.99076}],"risk":39.408875,"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://www.debian.org/security/2017/dsa-3773","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95813","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://security.netapp.com/advisory/ntap-20171019-0002/","https://security.paloaltonetworks.com/CVE-2017-3731","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3731","description":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."},"relatedVulnerabilities":[]},{"artifact":{"id":"d4c3653052dc4012","cpes":["cpe:2.3:a:libjetty-java:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty-java:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty_java:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty_java:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libjetty-java","purl":"pkg:deb/ubuntu/libjetty-java@6.1.26-1ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=jetty","type":"deb","version":"6.1.26-1ubuntu1.1","language":"","licenses":["Apache-2.0","LGPL-2","other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libjetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjetty-java.list"}],"upstreams":[{"name":"jetty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-28169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"jetty","version":"6.1.26-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-28169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-28169","cwe":"CWE-200","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28169","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28169","date":"2026-11-02","epss":0.7848,"percentile":0.99584}],"risk":39.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-28169"},"relatedVulnerabilities":[{"id":"CVE-2021-28169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"emo@eclipse.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28169","cwe":"CWE-200","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2021-28169","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28169","date":"2026-11-02","epss":0.7848,"percentile":0.99584}],"urls":["https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq","https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html","https://security.netapp.com/advisory/ntap-20210727-0009/","https://www.debian.org/security/2021/dsa-4949","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28169","description":"For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36222","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-11-02","epss":0.77236,"percentile":0.99554}],"risk":38.618,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36222"},"relatedVulnerabilities":[{"id":"CVE-2020-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-11-02","epss":0.77236,"percentile":0.99554}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9406","https://bugs.openldap.org/show_bug.cgi?id=9407","https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36227","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36227","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-11-02","epss":0.77236,"percentile":0.99554}],"risk":38.618,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36227"},"relatedVulnerabilities":[{"id":"CVE-2020-36227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-11-02","epss":0.77236,"percentile":0.99554}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9428","https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-33037","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33037","date":"2026-11-02","epss":0.74667,"percentile":0.99502}],"risk":37.3335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33037"},"relatedVulnerabilities":[{"id":"CVE-2021-33037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33037","date":"2026-11-02","epss":0.74667,"percentile":0.99502}],"urls":["https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://security.gentoo.org/glsa/202208-34","https://security.netapp.com/advisory/ntap-20210827-0007/","https://www.debian.org/security/2021/dsa-4952","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33037","description":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-33037","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33037","date":"2026-11-02","epss":0.74667,"percentile":0.99502}],"risk":37.3335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33037"},"relatedVulnerabilities":[{"id":"CVE-2021-33037","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-33037","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33037","date":"2026-11-02","epss":0.74667,"percentile":0.99502}],"urls":["https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://security.gentoo.org/glsa/202208-34","https://security.netapp.com/advisory/ntap-20210827-0007/","https://www.debian.org/security/2021/dsa-4952","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33037","description":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-02","epss":0.73721,"percentile":0.99475}],"risk":36.8605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-2650"},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-02","epss":0.73721,"percentile":0.99475}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-02","epss":0.73721,"percentile":0.99475}],"risk":36.8605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-2650"},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-11-02","epss":0.73721,"percentile":0.99475}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-6965","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"risk":36.726,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6965"},"relatedVulnerabilities":[{"id":"CVE-2025-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.3,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-11-02","epss":0.73452,"percentile":0.99465}],"urls":["https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8","http://seclists.org/fulldisclosure/2025/Sep/49","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/56","http://seclists.org/fulldisclosure/2025/Sep/57","http://seclists.org/fulldisclosure/2025/Sep/58","http://www.openwall.com/lists/oss-security/2025/09/06/1","https://cert-portal.siemens.com/productcert/html/ssa-225816.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-765416.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","description":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.9.1-1ubuntu0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:1.9.1-1ubuntu0.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:1.9.1-1ubuntu0.8"],"available":[{"date":"2018-06-05","kind":"advisory","version":"1:1.9.1-1ubuntu0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-11-02","epss":0.48062,"percentile":0.98858}],"risk":36.046499999999995,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-11-02","epss":0.48062,"percentile":0.98858}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.9.1-1ubuntu0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:1.9.1-1ubuntu0.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:1.9.1-1ubuntu0.8"],"available":[{"date":"2018-06-05","kind":"advisory","version":"1:1.9.1-1ubuntu0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-11-02","epss":0.48062,"percentile":0.98858}],"risk":36.046499999999995,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-11-02","epss":0.48062,"percentile":0.98858}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12616","versionConstraint":"< 7.0.52-1ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12616","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.14"],"available":[{"date":"2018-05-30","kind":"advisory","version":"7.0.52-1ubuntu0.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12616","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12616","date":"2026-11-02","epss":0.70118,"percentile":0.99378}],"risk":35.059000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12616"},"relatedVulnerabilities":[{"id":"CVE-2017-12616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12616","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12616","date":"2026-11-02","epss":0.70118,"percentile":0.99378}],"urls":["http://www.securityfocus.com/bid/100897","http://www.securitytracker.com/id/1039393","https://access.redhat.com/errata/RHSA-2018:0465","https://access.redhat.com/errata/RHSA-2018:0466","https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://security.netapp.com/advisory/ntap-20171018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://usn.ubuntu.com/3665-1/","https://www.synology.com/support/security/Synology_SA_17_54_Tomcat"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request."}]},{"artifact":{"id":"9a970c6653efeee4","cpes":["cpe:2.3:a:liblog4j1.2-java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2-java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*"],"name":"liblog4j1.2-java","purl":"pkg:deb/ubuntu/liblog4j1.2-java@1.2.17-4ubuntu3?arch=all&distro=ubuntu-14.04&upstream=apache-log4j1.2","type":"deb","version":"1.2.17-4ubuntu3","language":"","licenses":["sha256:b3bb57eaee4814882ed5ab7c94583073fe8eb9d3082703169252c446a8250047"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblog4j1.2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/liblog4j1.2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.list"}],"upstreams":[{"name":"apache-log4j1.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17571","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apache-log4j1.2","version":"1.2.17-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-17571","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17571","date":"2026-11-02","epss":0.6998,"percentile":0.99374}],"risk":34.99,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-17571"},"relatedVulnerabilities":[{"id":"CVE-2019-17571","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17571","date":"2026-11-02","epss":0.6998,"percentile":0.99374}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html","https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E","https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E","https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html","https://security.netapp.com/advisory/ntap-20200110-0001/","https://usn.ubuntu.com/4495-1/","https://www.debian.org/security/2020/dsa-4686","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17571","description":"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."}]},{"artifact":{"id":"9a970c6653efeee4","cpes":["cpe:2.3:a:liblog4j1.2-java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2-java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*"],"name":"liblog4j1.2-java","purl":"pkg:deb/ubuntu/liblog4j1.2-java@1.2.17-4ubuntu3?arch=all&distro=ubuntu-14.04&upstream=apache-log4j1.2","type":"deb","version":"1.2.17-4ubuntu3","language":"","licenses":["sha256:b3bb57eaee4814882ed5ab7c94583073fe8eb9d3082703169252c446a8250047"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblog4j1.2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/liblog4j1.2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.list"}],"upstreams":[{"name":"apache-log4j1.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23305","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apache-log4j1.2","version":"1.2.17-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23305","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23305","date":"2026-11-02","epss":0.66537,"percentile":0.99285}],"risk":33.2685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23305"},"relatedVulnerabilities":[{"id":"CVE-2022-23305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23305","date":"2026-11-02","epss":0.66537,"percentile":0.99285}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/4","https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y","https://logging.apache.org/log4j/1.2/index.html","https://security.netapp.com/advisory/ntap-20220217-0007/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23305","description":"By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-27212","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-11-02","epss":0.66114,"percentile":0.99275}],"risk":33.056999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-27212"},"relatedVulnerabilities":[{"id":"CVE-2021-27212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-11-02","epss":0.66114,"percentile":0.99275}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9454","https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0","https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html","https://security.netapp.com/advisory/ntap-20210319-0005/","https://www.debian.org/security/2021/dsa-4860","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-29155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-29155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-11-02","epss":0.64487,"percentile":0.99237}],"risk":32.243500000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-29155"},"relatedVulnerabilities":[{"id":"CVE-2022-29155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-11-02","epss":0.64487,"percentile":0.99237}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9815","https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html","https://security.netapp.com/advisory/ntap-20220609-0007/","https://www.debian.org/security/2022/dsa-5140","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."}]},{"artifact":{"id":"2d3cdd73855dd6e7","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.4:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.4","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-14287","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-14287","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-14287","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14287","date":"2026-11-02","epss":0.63764,"percentile":0.9922}],"risk":31.881999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-14287"},"relatedVulnerabilities":[{"id":"CVE-2019-14287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14287","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14287","date":"2026-11-02","epss":0.63764,"percentile":0.9922}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html","http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html","http://www.openwall.com/lists/oss-security/2019/10/14/1","http://www.openwall.com/lists/oss-security/2019/10/24/1","http://www.openwall.com/lists/oss-security/2019/10/29/3","http://www.openwall.com/lists/oss-security/2021/09/14/2","https://access.redhat.com/errata/RHBA-2019:3248","https://access.redhat.com/errata/RHSA-2019:3197","https://access.redhat.com/errata/RHSA-2019:3204","https://access.redhat.com/errata/RHSA-2019:3205","https://access.redhat.com/errata/RHSA-2019:3209","https://access.redhat.com/errata/RHSA-2019:3219","https://access.redhat.com/errata/RHSA-2019:3278","https://access.redhat.com/errata/RHSA-2019:3694","https://access.redhat.com/errata/RHSA-2019:3754","https://access.redhat.com/errata/RHSA-2019:3755","https://access.redhat.com/errata/RHSA-2019:3895","https://access.redhat.com/errata/RHSA-2019:3916","https://access.redhat.com/errata/RHSA-2019:3941","https://access.redhat.com/errata/RHSA-2019:4191","https://access.redhat.com/errata/RHSA-2020:0388","https://lists.debian.org/debian-lts-announce/2019/10/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/","https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287","https://seclists.org/bugtraq/2019/Oct/20","https://seclists.org/bugtraq/2019/Oct/21","https://security.gentoo.org/glsa/202003-12","https://security.netapp.com/advisory/ntap-20191017-0003/","https://support.f5.com/csp/article/K53746212?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us","https://usn.ubuntu.com/4154-1/","https://www.debian.org/security/2019/dsa-4543","https://www.openwall.com/lists/oss-security/2019/10/15/2","https://www.sudo.ws/alerts/minus_1_uid.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14287","description":"In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a \"sudo -u \\#$((0xffffffff))\" command."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-1938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-1938","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-1938","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1938","date":"2026-11-02","epss":0.9927,"percentile":0.99937}],"risk":31.5,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-1938","knownExploited":[{"cve":"CVE-2020-1938","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-1938"],"dueDate":"2022-03-17","product":"Tomcat","dateAdded":"2022-03-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2020-1938","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1938","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1938","date":"2026-11-02","epss":0.9927,"percentile":0.99937}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html","http://support.blackberry.com/kb/articleDetail?articleNumber=000062739","https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E","https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E","https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E","https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html","https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/","https://security.gentoo.org/glsa/202003-43","https://security.netapp.com/advisory/ntap-20200226-0002/","https://www.debian.org/security/2020/dsa-4673","https://www.debian.org/security/2020/dsa-4680","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1938"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1938","description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","knownExploited":[{"cve":"CVE-2020-1938","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-1938"],"dueDate":"2022-03-17","product":"Tomcat","dateAdded":"2022-03-03","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2015-3194","versionConstraint":">= 4.0.0, < 4.2.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2015-3194","fix":{"state":"fixed","versions":["4.2.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.2.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3194","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3194","date":"2026-11-02","epss":0.44016,"percentile":0.98752}],"risk":30.261,"urls":["http://fortiguard.com/advisory/openssl-advisory-december-2015","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761","http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173801.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00070.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00071.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00087.html","http://marc.info/?l=bugtraq&m=145382583417444&w=2","http://openssl.org/news/secadv/20151203.txt","http://rhn.redhat.com/errata/RHSA-2015-2617.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl","http://www.debian.org/security/2015/dsa-3413","http://www.fortiguard.com/advisory/openssl-advisory-december-2015","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/78623","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1034294","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583","http://www.ubuntu.com/usn/USN-2830-1","https://bugzilla.redhat.com/show_bug.cgi?id=1288320","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c394a488942387246653833359a5c94b5832674e","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d8541d7e9e63bf5f343af24644046c8d96498c17","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944173","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3194","description":"crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter."},"relatedVulnerabilities":[]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15473","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-15473","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-11-02","epss":0.98675,"percentile":0.99924}],"risk":29.6025,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-15473"},"relatedVulnerabilities":[{"id":"CVE-2018-15473","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-11-02","epss":0.98675,"percentile":0.99924}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/15/5","http://www.securityfocus.com/bid/105140","http://www.securitytracker.com/id/1041487","https://access.redhat.com/errata/RHSA-2019:0711","https://access.redhat.com/errata/RHSA-2019:2143","https://bugs.debian.org/906236","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0","https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011","https://security.gentoo.org/glsa/201810-03","https://security.netapp.com/advisory/ntap-20181101-0001/","https://usn.ubuntu.com/3809-1/","https://www.debian.org/security/2018/dsa-4280","https://www.exploit-db.com/exploits/45210/","https://www.exploit-db.com/exploits/45233/","https://www.exploit-db.com/exploits/45939/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-6303","versionConstraint":"< 0.12.16||>= 4.0.0, < 4.6.0||>= 6.0.0, < 6.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-6303","fix":{"state":"fixed","versions":["0.12.16","4.6.0","6.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"0.12.16"},{"date":"2025-09-04","kind":"first-observed","version":"4.6.0"},{"date":"2025-09-04","kind":"first-observed","version":"6.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-11-02","epss":0.31985,"percentile":0.9831}],"risk":28.226762500000003,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92984","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1370146","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6303","description":"Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."},"relatedVulnerabilities":[]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-23521","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23521","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23521","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-23521","date":"2026-11-02","epss":0.56334,"percentile":0.99053}],"risk":28.166999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23521"},"relatedVulnerabilities":[{"id":"CVE-2022-23521","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23521","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-23521","date":"2026-11-02","epss":0.56334,"percentile":0.99053}],"urls":["https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23521","description":"Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23521","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23521","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23521","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-23521","date":"2026-11-02","epss":0.56334,"percentile":0.99053}],"risk":28.166999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23521"},"relatedVulnerabilities":[{"id":"CVE-2022-23521","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23521","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-23521","date":"2026-11-02","epss":0.56334,"percentile":0.99053}],"urls":["https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23521","description":"Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue."}]},{"artifact":{"id":"2d3cdd73855dd6e7","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.4:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.4","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-22809","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-22809","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-22809","date":"2026-11-02","epss":0.55367,"percentile":0.99033}],"risk":27.6835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-22809"},"relatedVulnerabilities":[{"id":"CVE-2023-22809","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-22809","date":"2026-11-02","epss":0.55367,"percentile":0.99033}],"urls":["http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html","http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html","http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html","http://seclists.org/fulldisclosure/2023/Aug/21","http://www.openwall.com/lists/oss-security/2023/01/19/1","https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/","https://security.gentoo.org/glsa/202305-12","https://security.netapp.com/advisory/ntap-20230127-0015/","https://support.apple.com/kb/HT213758","https://www.debian.org/security/2023/dsa-5321","https://www.sudo.ws/security/advisories/sudoedit_any/","https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-22809","description":"In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a \"--\" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.4.4"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-2105","versionConstraint":">= 4.2.0, < 4.4.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2105","fix":{"state":"fixed","versions":["4.4.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.4.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2105","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2105","date":"2026-11-02","epss":0.3965,"percentile":0.98617}],"risk":27.259375000000002,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html","http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html","http://rhn.redhat.com/errata/RHSA-2016-0722.html","http://rhn.redhat.com/errata/RHSA-2016-0996.html","http://rhn.redhat.com/errata/RHSA-2016-1648.html","http://rhn.redhat.com/errata/RHSA-2016-1649.html","http://rhn.redhat.com/errata/RHSA-2016-1650.html","http://rhn.redhat.com/errata/RHSA-2016-2056.html","http://rhn.redhat.com/errata/RHSA-2016-2073.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl","http://www.debian.org/security/2016/dsa-3566","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/89757","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1035721","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103","http://www.ubuntu.com/usn/USN-2959-1","https://bto.bluecoat.com/security-advisory/sa123","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=5b814481f3573fa9677f3a31ee51322e2a22ee6a","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://kc.mcafee.com/corporate/index?page=content&id=SB10160","https://security.gentoo.org/glsa/201612-16","https://security.netapp.com/advisory/ntap-20160504-0001/","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.apple.com/HT206903","https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc","https://www.openssl.org/news/secadv/20160503.txt","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2105","description":"Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data."},"relatedVulnerabilities":[]},{"artifact":{"id":"9a970c6653efeee4","cpes":["cpe:2.3:a:liblog4j1.2-java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2-java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*"],"name":"liblog4j1.2-java","purl":"pkg:deb/ubuntu/liblog4j1.2-java@1.2.17-4ubuntu3?arch=all&distro=ubuntu-14.04&upstream=apache-log4j1.2","type":"deb","version":"1.2.17-4ubuntu3","language":"","licenses":["sha256:b3bb57eaee4814882ed5ab7c94583073fe8eb9d3082703169252c446a8250047"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblog4j1.2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/liblog4j1.2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.list"}],"upstreams":[{"name":"apache-log4j1.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23307","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apache-log4j1.2","version":"1.2.17-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23307","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23307","date":"2026-11-02","epss":0.54411,"percentile":0.99013}],"risk":27.2055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23307"},"relatedVulnerabilities":[{"id":"CVE-2022-23307","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23307","date":"2026-11-02","epss":0.54411,"percentile":0.99013}],"urls":["https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh","https://logging.apache.org/log4j/1.2/index.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23307","description":"CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-25236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-11-02","epss":0.35271,"percentile":0.98444}],"risk":26.45325,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-25236"},"relatedVulnerabilities":[{"id":"CVE-2022-25236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-11-02","epss":0.35271,"percentile":0.98444}],"urls":["http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/561","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-484086.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","description":"xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-25652","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-25652","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-25652","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-25652","date":"2026-11-02","epss":0.51883,"percentile":0.98951}],"risk":25.9415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-25652"},"relatedVulnerabilities":[{"id":"CVE-2023-25652","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-25652","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-25652","date":"2026-11-02","epss":0.51883,"percentile":0.98951}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/25/2","https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902","https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e","https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","https://security.gentoo.org/glsa/202312-15","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-25652","description":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-25652","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-25652","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-25652","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-25652","date":"2026-11-02","epss":0.51883,"percentile":0.98951}],"risk":25.9415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-25652"},"relatedVulnerabilities":[{"id":"CVE-2023-25652","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-25652","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-25652","date":"2026-11-02","epss":0.51883,"percentile":0.98951}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/25/2","https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902","https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e","https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","https://security.gentoo.org/glsa/202312-15","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-25652","description":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists."}]},{"artifact":{"id":"43b18cd631916f9e","cpes":["cpe:2.3:a:klibc-utils:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc-utils:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*"],"name":"klibc-utils","purl":"pkg:deb/ubuntu/klibc-utils@2.0.3-0ubuntu1.14.04.2?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.2","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/klibc-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.list"},{"path":"/var/lib/dpkg/info/klibc-utils.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.postinst"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"01c2d3b342249ec1","cpes":["cpe:2.3:a:libklibc:libklibc:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*"],"name":"libklibc","purl":"pkg:deb/ubuntu/libklibc@2.0.3-0ubuntu1.14.04.2?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.2","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libklibc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libklibc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libklibc.list"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"a1d1894adfb63c2e","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-1ubuntu1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.8.dfsg-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=zlib","type":"deb","version":"1:1.2.8.dfsg-1ubuntu1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-11-02","epss":0.51733,"percentile":0.98948}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"5699f089c9edef9d","cpes":["cpe:2.3:a:libcommons-collections3-java:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3-java:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3_java:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3_java:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-collections3:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_collections3:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons-collections3-java:3.2.1-6:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons_collections3_java:3.2.1-6:*:*:*:*:*:*:*"],"name":"libcommons-collections3-java","purl":"pkg:deb/ubuntu/libcommons-collections3-java@3.2.1-6?arch=all&distro=ubuntu-14.04","type":"deb","version":"3.2.1-6","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcommons-collections3-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libcommons-collections3-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-collections3-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-collections3-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-collections3-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-collections3-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-7501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libcommons-collections3-java","version":"3.2.1-6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-7501","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-7501","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7501","date":"2026-11-02","epss":0.85562,"percentile":0.99723}],"risk":25.6686,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-7501"},"relatedVulnerabilities":[{"id":"CVE-2015-7501","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7501","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7501","date":"2026-11-02","epss":0.85562,"percentile":0.99723}],"urls":["http://rhn.redhat.com/errata/RHSA-2015-2500.html","http://rhn.redhat.com/errata/RHSA-2015-2501.html","http://rhn.redhat.com/errata/RHSA-2015-2502.html","http://rhn.redhat.com/errata/RHSA-2015-2514.html","http://rhn.redhat.com/errata/RHSA-2015-2516.html","http://rhn.redhat.com/errata/RHSA-2015-2517.html","http://rhn.redhat.com/errata/RHSA-2015-2521.html","http://rhn.redhat.com/errata/RHSA-2015-2522.html","http://rhn.redhat.com/errata/RHSA-2015-2524.html","http://rhn.redhat.com/errata/RHSA-2015-2670.html","http://rhn.redhat.com/errata/RHSA-2015-2671.html","http://rhn.redhat.com/errata/RHSA-2016-0040.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/78215","http://www.securitytracker.com/id/1034097","http://www.securitytracker.com/id/1037052","http://www.securitytracker.com/id/1037053","http://www.securitytracker.com/id/1037640","https://access.redhat.com/security/vulnerabilities/2059393","https://access.redhat.com/solutions/2045023","https://bugzilla.redhat.com/show_bug.cgi?id=1279330","https://rhn.redhat.com/errata/RHSA-2015-2536.html","https://security.netapp.com/advisory/ntap-20240216-0010/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7501","description":"Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-11-02","epss":0.50445,"percentile":0.98913}],"risk":25.222499999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3712"},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-11-02","epss":0.50445,"percentile":0.98913}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-11-02","epss":0.50445,"percentile":0.98913}],"risk":25.222499999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3712"},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-11-02","epss":0.50445,"percentile":0.98913}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-11-02","epss":0.49739,"percentile":0.98896}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"c3d1461911450c05","cpes":["cpe:2.3:a:libdb5.3:libdb5.3:5.3.28-3ubuntu3:*:*:*:*:*:*:*"],"name":"libdb5.3","purl":"pkg:deb/ubuntu/libdb5.3@5.3.28-3ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=db5.3","type":"deb","version":"5.3.28-3ubuntu3","language":"","licenses":["sha256:b3bbc6fbb3f2a0e6a487e953eb8c3cc4bdb6f4150f7f51d20b1e9a3c8ef92d3d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdb5.3/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libdb5.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"db5.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"db5.3","version":"5.3.28-3ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-11-02","epss":0.45426,"percentile":0.98791}],"risk":22.713,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-11-02","epss":0.45426,"percentile":0.98791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-11-02","epss":0.45426,"percentile":0.98791}],"risk":22.713,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-11-02","epss":0.45426,"percentile":0.98791}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-41903","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-41903","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41903","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41903","date":"2026-11-02","epss":0.44268,"percentile":0.98759}],"risk":22.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41903"},"relatedVulnerabilities":[{"id":"CVE-2022-41903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41903","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41903","date":"2026-11-02","epss":0.44268,"percentile":0.98759}],"urls":["https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst","https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem","https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41903","description":"Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41903","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-41903","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41903","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41903","date":"2026-11-02","epss":0.44268,"percentile":0.98759}],"risk":22.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41903"},"relatedVulnerabilities":[{"id":"CVE-2022-41903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41903","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41903","date":"2026-11-02","epss":0.44268,"percentile":0.98759}],"urls":["https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst","https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem","https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41903","description":"Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."}]},{"artifact":{"id":"44dda7f4925857f1","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/ubuntu/libnss3@2%3A3.28.4-0ubuntu0.14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=nss","type":"deb","version":"2:3.28.4-0ubuntu0.14.04.3","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.28.4-0ubuntu0.14.04.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12404","versionConstraint":"< 2:3.28.4-0ubuntu0.14.04.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"nss","version":"2:3.28.4-0ubuntu0.14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12404","fix":{"state":"fixed","versions":["2:3.28.4-0ubuntu0.14.04.4"],"available":[{"date":"2019-01-09","kind":"advisory","version":"2:3.28.4-0ubuntu0.14.04.4"}]},"cvss":[],"epss":[{"cve":"CVE-2018-12404","date":"2026-11-02","epss":0.44248,"percentile":0.98758}],"risk":22.124,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12404"},"relatedVulnerabilities":[{"id":"CVE-2018-12404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-12404","date":"2026-11-02","epss":0.44248,"percentile":0.98758}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html","http://www.securityfocus.com/bid/107260","https://access.redhat.com/errata/RHSA-2019:2237","https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41."}]},{"artifact":{"id":"70f15653198a19ec","cpes":["cpe:2.3:a:libnss3-nssdb:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-nssdb:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_nssdb:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_nssdb:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*"],"name":"libnss3-nssdb","purl":"pkg:deb/ubuntu/libnss3-nssdb@2%3A3.28.4-0ubuntu0.14.04.3?arch=all&distro=ubuntu-14.04&upstream=nss","type":"deb","version":"2:3.28.4-0ubuntu0.14.04.3","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-nssdb/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnss3-nssdb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-nssdb.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3-nssdb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-nssdb.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3-nssdb.list"}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.28.4-0ubuntu0.14.04.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12404","versionConstraint":"< 2:3.28.4-0ubuntu0.14.04.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"nss","version":"2:3.28.4-0ubuntu0.14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12404","fix":{"state":"fixed","versions":["2:3.28.4-0ubuntu0.14.04.4"],"available":[{"date":"2019-01-09","kind":"advisory","version":"2:3.28.4-0ubuntu0.14.04.4"}]},"cvss":[],"epss":[{"cve":"CVE-2018-12404","date":"2026-11-02","epss":0.44248,"percentile":0.98758}],"risk":22.124,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12404"},"relatedVulnerabilities":[{"id":"CVE-2018-12404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-12404","date":"2026-11-02","epss":0.44248,"percentile":0.98758}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html","http://www.securityfocus.com/bid/107260","https://access.redhat.com/errata/RHSA-2019:2237","https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41."}]},{"artifact":{"id":"4cc0d756033f0575","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2774","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2774","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-11-02","epss":0.73622,"percentile":0.9947}],"risk":22.086599999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2774"},"relatedVulnerabilities":[{"id":"CVE-2016-2774","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-11-02","epss":0.73622,"percentile":0.9947}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183458.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183640.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html","http://rhn.redhat.com/errata/RHSA-2016-2590.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/84208","http://www.securitytracker.com/id/1035196","https://kb.isc.org/article/AA-01354","https://lists.debian.org/debian-lts-announce/2019/11/msg00023.html","https://usn.ubuntu.com/3586-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2774","description":"ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions."}]},{"artifact":{"id":"882b065c3207d168","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2774","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2774","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-11-02","epss":0.73622,"percentile":0.9947}],"risk":22.086599999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2774"},"relatedVulnerabilities":[{"id":"CVE-2016-2774","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-11-02","epss":0.73622,"percentile":0.9947}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183458.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183640.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html","http://rhn.redhat.com/errata/RHSA-2016-2590.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/84208","http://www.securitytracker.com/id/1035196","https://kb.isc.org/article/AA-01354","https://lists.debian.org/debian-lts-announce/2019/11/msg00023.html","https://usn.ubuntu.com/3586-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2774","description":"ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions."}]},{"artifact":{"id":"4cc0d756033f0575","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3144","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3144","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-11-02","epss":0.72724,"percentile":0.99447}],"risk":21.8172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3144"},"relatedVulnerabilities":[{"id":"CVE-2017-3144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-11-02","epss":0.72724,"percentile":0.99447}],"urls":["http://www.securityfocus.com/bid/102726","http://www.securitytracker.com/id/1040194","https://access.redhat.com/errata/RHSA-2018:0158","https://kb.isc.org/docs/aa-01541","https://usn.ubuntu.com/3586-1/","https://www.debian.org/security/2018/dsa-4133"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3144","description":"A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested."}]},{"artifact":{"id":"882b065c3207d168","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3144","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3144","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-11-02","epss":0.72724,"percentile":0.99447}],"risk":21.8172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3144"},"relatedVulnerabilities":[{"id":"CVE-2017-3144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-11-02","epss":0.72724,"percentile":0.99447}],"urls":["http://www.securityfocus.com/bid/102726","http://www.securitytracker.com/id/1040194","https://access.redhat.com/errata/RHSA-2018:0158","https://kb.isc.org/docs/aa-01541","https://usn.ubuntu.com/3586-1/","https://www.debian.org/security/2018/dsa-4133"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3144","description":"A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-6306","versionConstraint":">= 4.2.0, < 4.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-6306","fix":{"state":"fixed","versions":["4.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-11-02","epss":0.41683,"percentile":0.98685}],"risk":21.049915,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93153","http://www.securitytracker.com/id/1036885","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K90492697","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6306","description":"The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"bdc0cdec1fd8d2d8","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.10:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.10?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.10","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-40303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-40303","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40303","date":"2026-11-02","epss":0.41365,"percentile":0.98671}],"risk":20.6825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40303"},"relatedVulnerabilities":[{"id":"CVE-2022-40303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40303","date":"2026-11-02","epss":0.41365,"percentile":0.98671}],"urls":["http://seclists.org/fulldisclosure/2022/Dec/21","http://seclists.org/fulldisclosure/2022/Dec/24","http://seclists.org/fulldisclosure/2022/Dec/25","http://seclists.org/fulldisclosure/2022/Dec/26","http://seclists.org/fulldisclosure/2022/Dec/27","https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0","https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3","https://security.netapp.com/advisory/ntap-20221209-0003/","https://support.apple.com/kb/HT213531","https://support.apple.com/kb/HT213533","https://support.apple.com/kb/HT213534","https://support.apple.com/kb/HT213535","https://support.apple.com/kb/HT213536","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40303","description":"An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-7052","versionConstraint":">= 4.2.0, < 4.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7052","fix":{"state":"fixed","versions":["4.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7052","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7052","date":"2026-11-02","epss":0.29462,"percentile":0.98184}],"risk":20.255125,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/93171","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=6e629b5be45face20b4ca71c4fcbfed78b864a2e","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:27.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.openssl.org/news/secadv/20160926.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-19","https://www.tenable.com/security/tns-2016-20"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7052","description":"crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a6e543b92a4ef77","cpes":["cpe:2.3:a:krb5-locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5-locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"krb5-locales","purl":"pkg:deb/ubuntu/krb5-locales@1.12%2Bdfsg-2ubuntu5.3?arch=all&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-locales/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/krb5-locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"risk":19.9125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"822a09707628283f","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"risk":19.9125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"09841dafbf852f74","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"risk":19.9125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"4ce9194e589daeec","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"risk":19.9125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"93d7ce3a1a88f7d6","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"risk":19.9125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-11-02","epss":0.39825,"percentile":0.98623}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-6816","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6816","date":"2026-11-02","epss":0.39633,"percentile":0.98616}],"risk":19.8165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6816"},"relatedVulnerabilities":[{"id":"CVE-2016-6816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"impactScore":3.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6816","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6816","date":"2026-11-02","epss":0.39633,"percentile":0.98616}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0244.html","http://rhn.redhat.com/errata/RHSA-2017-0245.html","http://rhn.redhat.com/errata/RHSA-2017-0246.html","http://rhn.redhat.com/errata/RHSA-2017-0247.html","http://rhn.redhat.com/errata/RHSA-2017-0250.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2016/dsa-3738","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94461","http://www.securitytracker.com/id/1037332","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180607-0001/","https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48","https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13","https://usn.ubuntu.com/4557-1/","https://www.exploit-db.com/exploits/41783/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6816","description":"The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own."}]},{"artifact":{"id":"9a970c6653efeee4","cpes":["cpe:2.3:a:liblog4j1.2-java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2-java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2_java:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2-java:1.2.17-4ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:liblog4j1.2:liblog4j1.2_java:1.2.17-4ubuntu3:*:*:*:*:*:*:*"],"name":"liblog4j1.2-java","purl":"pkg:deb/ubuntu/liblog4j1.2-java@1.2.17-4ubuntu3?arch=all&distro=ubuntu-14.04&upstream=apache-log4j1.2","type":"deb","version":"1.2.17-4ubuntu3","language":"","licenses":["sha256:b3bb57eaee4814882ed5ab7c94583073fe8eb9d3082703169252c446a8250047"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblog4j1.2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/liblog4j1.2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblog4j1.2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/liblog4j1.2-java.list"}],"upstreams":[{"name":"apache-log4j1.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23302","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apache-log4j1.2","version":"1.2.17-4ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23302","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23302","date":"2026-11-02","epss":0.63841,"percentile":0.99222}],"risk":19.1523,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23302"},"relatedVulnerabilities":[{"id":"CVE-2022-23302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23302","date":"2026-11-02","epss":0.63841,"percentile":0.99222}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/3","https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w","https://logging.apache.org/log4j/1.2/index.html","https://security.netapp.com/advisory/ntap-20220217-0006/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23302","description":"JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"20.20.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-21710","versionConstraint":"< 20.20.2||>= 21, < 22.22.2||>= 23, < 24.14.1||>= 25, < 25.8.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-21710","fix":{"state":"fixed","versions":["20.20.2","22.22.2","24.14.1","25.8.2"],"available":[{"date":"2026-04-03","kind":"first-observed","version":"20.20.2"},{"date":"2026-04-11","kind":"first-observed","version":"22.22.2"},{"date":"2026-04-03","kind":"first-observed","version":"24.14.1"},{"date":"2026-04-03","kind":"first-observed","version":"25.8.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"support@hackerone.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21710","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-21710","cwe":"CWE-843","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-21710","date":"2026-11-02","epss":0.25443,"percentile":0.97949}],"risk":19.082250000000002,"urls":["https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-21710","https://bugzilla.redhat.com/show_bug.cgi?id=2453151","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","description":"A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**"},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2684","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 12, < 12.0.1||>= 7, < 7.0.221||>= 8, < 8.0.211||>= 9, < 11.0.3 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2684","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 12, < 12.0.1||>= 7, < 7.0.221||>= 8, < 8.0.211||>= 9, < 11.0.3 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2684","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 12, < 12.0.1||>= 7, < 7.0.221||>= 8, < 8.0.211||>= 9, < 11.0.3 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-2684","fix":{"state":"fixed","versions":["1.7.0_221","7.0.221","1.8.0_211","8.0.211","11.0.3","12.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_221"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_211"},{"date":"2025-09-04","kind":"first-observed","version":"12.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.221"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.211"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2684","date":"2026-11-02","epss":0.37618,"percentile":0.98537}],"risk":18.99709,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.openwall.com/lists/oss-security/2020/09/01/4","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://access.redhat.com/errata/RHSA-2019:1518","https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2684","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2684","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2684","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2684","date":"2026-11-02","epss":0.37618,"percentile":0.98537}],"risk":18.809,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2684"},"relatedVulnerabilities":[{"id":"CVE-2019-2684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2684","date":"2026-11-02","epss":0.37618,"percentile":0.98537}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.openwall.com/lists/oss-security/2020/09/01/4","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://access.redhat.com/errata/RHSA-2019:1518","https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2684","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2684","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2684","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2684","date":"2026-11-02","epss":0.37618,"percentile":0.98537}],"risk":18.809,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2684"},"relatedVulnerabilities":[{"id":"CVE-2019-2684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2684","date":"2026-11-02","epss":0.37618,"percentile":0.98537}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.openwall.com/lists/oss-security/2020/09/01/4","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://access.redhat.com/errata/RHSA-2019:1518","https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2684","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3092","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-11-02","epss":0.37171,"percentile":0.9852}],"risk":18.5855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3092"},"relatedVulnerabilities":[{"id":"CVE-2016-3092","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-11-02","epss":0.37171,"percentile":0.9852}],"urls":["http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91453","http://www.securitytracker.com/id/1036427","http://www.securitytracker.com/id/1036900","http://www.securitytracker.com/id/1037029","http://www.securitytracker.com/id/1039606","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.gentoo.org/glsa/202107-39","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","description":"The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-0797","versionConstraint":">= 4.2.0, < 4.3.2 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-0797","fix":{"state":"fixed","versions":["4.3.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.3.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0797","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0797","date":"2026-11-02","epss":0.27022,"percentile":0.98044}],"risk":18.577625,"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html","http://marc.info/?l=bugtraq&m=145889460330120&w=2","http://openssl.org/news/secadv/20160301.txt","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-openssl","http://www.debian.org/security/2016/dsa-3500","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/83763","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1035133","http://www.ubuntu.com/usn/USN-2914-1","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c175308407858afff3fc8c2e5e085d94d12edc7d","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168","https://kc.mcafee.com/corporate/index?page=content&id=SB10156","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:12.openssl.asc","https://security.gentoo.org/glsa/201603-15","https://www.openssl.org/news/secadv/20160301.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0797","description":"Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.25.v20180606"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6x9x-8qw9-9pp6","versionConstraint":"<9.2.25.v20180606 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6x9x-8qw9-9pp6","fix":{"state":"fixed","versions":["9.2.25.v20180606"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.2.25.v20180606"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7658","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2017-7658","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7658","date":"2026-11-02","epss":0.18996,"percentile":0.97303}],"risk":17.85624,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-7658","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securityfocus.com/bid/106566","http://www.securitytracker.com/id/1041194"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6x9x-8qw9-9pp6","description":"Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)"},"relatedVulnerabilities":[{"id":"CVE-2017-7658","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7658","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2017-7658","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7658","date":"2026-11-02","epss":0.18996,"percentile":0.97303}],"urls":["http://www.securityfocus.com/bid/106566","http://www.securitytracker.com/id/1041194","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7658","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-0221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-0221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-0221","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0221","date":"2026-11-02","epss":0.59194,"percentile":0.99116}],"risk":17.7582,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-0221"},"relatedVulnerabilities":[{"id":"CVE-2019-0221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0221","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0221","date":"2026-11-02","epss":0.59194,"percentile":0.99116}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2019/May/50","http://www.securityfocus.com/bid/108545","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","https://seclists.org/bugtraq/2019/Dec/43","https://security.gentoo.org/glsa/202003-43","https://security.netapp.com/advisory/ntap-20190606-0001/","https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4128-1/","https://usn.ubuntu.com/4128-2/","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0221","description":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6111","versionConstraint":"< 1:6.6p1-2ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6111","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.13"],"available":[{"date":"2019-03-04","kind":"advisory","version":"1:6.6p1-2ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-11-02","epss":0.58204,"percentile":0.99093}],"risk":17.461199999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6111"},"relatedVulnerabilities":[{"id":"CVE-2019-6111","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-11-02","epss":0.58204,"percentile":0.99093}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","http://www.openwall.com/lists/oss-security/2019/04/18/1","http://www.openwall.com/lists/oss-security/2022/08/02/1","http://www.securityfocus.com/bid/106741","https://access.redhat.com/errata/RHSA-2019:3702","https://bugzilla.redhat.com/show_bug.cgi?id=1677794","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://usn.ubuntu.com/3885-1/","https://usn.ubuntu.com/3885-2/","https://www.debian.org/security/2019/dsa-4387","https://www.exploit-db.com/exploits/46193/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-412672.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file)."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2015-3193","versionConstraint":">= 4.2.0, < 4.2.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2015-3193","fix":{"state":"fixed","versions":["4.2.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.2.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3193","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3193","date":"2026-11-02","epss":0.25137,"percentile":0.97931}],"risk":17.281687499999997,"urls":["http://fortiguard.com/advisory/openssl-advisory-december-2015","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761","http://openssl.org/news/secadv/20151203.txt","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl","http://www.fortiguard.com/advisory/openssl-advisory-december-2015","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/78705","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1034294","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583","http://www.ubuntu.com/usn/USN-2830-1","https://blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.html","https://bugzilla.redhat.com/show_bug.cgi?id=1288317","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d73cc256c8e256c32ed959456101b73ba9842f72","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322","https://kb.isc.org/article/AA-01438","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3193","description":"The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-9484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-9484","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-9484","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9484","date":"2026-11-02","epss":0.5552,"percentile":0.99036}],"risk":16.656000000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-9484"},"relatedVulnerabilities":[{"id":"CVE-2020-9484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.4,"impactScore":6.5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9484","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9484","date":"2026-11-02","epss":0.5552,"percentile":0.99036}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html","http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html","http://seclists.org/fulldisclosure/2020/Jun/6","http://www.openwall.com/lists/oss-security/2021/03/01/2","https://kc.mcafee.com/corporate/index?page=content&id=SB10332","https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/","https://security.gentoo.org/glsa/202006-21","https://security.netapp.com/advisory/ntap-20200528-0005/","https://usn.ubuntu.com/4448-1/","https://usn.ubuntu.com/4596-1/","https://www.debian.org/security/2020/dsa-4727","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48976","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-48976","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"risk":16.4385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48976"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-11-02","epss":0.32877,"percentile":0.98355}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"b37dbcb586168da6","cpes":["cpe:2.3:a:busybox-initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox-initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*"],"name":"busybox-initramfs","purl":"pkg:deb/ubuntu/busybox-initramfs@1%3A1.21.0-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=busybox","type":"deb","version":"1:1.21.0-1ubuntu1","language":"","licenses":["sha256:336d995e819d3a7a3fdbf3f5041c07094f75ee849acb3bb742b7503d45786329"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/busybox-initramfs/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/busybox-initramfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/busybox-initramfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/busybox-initramfs.list"}],"upstreams":[{"name":"busybox"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.21.0-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000517","versionConstraint":"< 1:1.21.0-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"busybox","version":"1:1.21.0-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000517","fix":{"state":"fixed","versions":["1:1.21.0-1ubuntu1.4"],"available":[{"date":"2019-04-03","kind":"advisory","version":"1:1.21.0-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-11-02","epss":0.32483,"percentile":0.98337}],"risk":16.241500000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000517"},"relatedVulnerabilities":[{"id":"CVE-2018-1000517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-11-02","epss":0.32483,"percentile":0.98337}],"urls":["https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000517","description":"BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-11-02","epss":0.52421,"percentile":0.98964}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5388","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-5388","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5388","date":"2026-11-02","epss":0.50896,"percentile":0.98927}],"risk":15.268799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5388"},"relatedVulnerabilities":[{"id":"CVE-2016-5388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5388","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5388","date":"2026-11-02","epss":0.50896,"percentile":0.98927}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://rhn.redhat.com/errata/RHSA-2016-1624.html","http://rhn.redhat.com/errata/RHSA-2016-2045.html","http://rhn.redhat.com/errata/RHSA-2016-2046.html","http://www.kb.cert.org/vuls/id/797896","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.securityfocus.com/bid/91818","http://www.securitytracker.com/id/1036331","https://access.redhat.com/errata/RHSA-2016:1635","https://access.redhat.com/errata/RHSA-2016:1636","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://httpoxy.org/","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://tomcat.apache.org/tomcat-7.0-doc/changelog.html","https://www.apache.org/security/asf-httpoxy-response.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5388","description":"Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388\"; in other words, this is not a CVE ID for a vulnerability."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-11-02","epss":0.50732,"percentile":0.98922}],"risk":15.2196,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23840"},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-11-02","epss":0.50732,"percentile":0.98922}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-11-02","epss":0.50732,"percentile":0.98922}],"risk":15.2196,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23840"},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-11-02","epss":0.50732,"percentile":0.98922}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-48988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"risk":15.2165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48988"},"relatedVulnerabilities":[{"id":"CVE-2025-48988","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"urls":["https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","http://www.openwall.com/lists/oss-security/2025/06/16/1","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-48988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-48988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"risk":15.2165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-48988"},"relatedVulnerabilities":[{"id":"CVE-2025-48988","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48988","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2025-48988","date":"2026-11-02","epss":0.30433,"percentile":0.98235}],"urls":["https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","http://www.openwall.com/lists/oss-security/2025/06/16/1","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."}]},{"artifact":{"id":"4b585ce20b0b290d","cpes":["cpe:2.3:a:libcommons-beanutils-java:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils-java:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils_java:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils_java:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-beanutils:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_beanutils:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons-beanutils-java:1.9.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons_beanutils_java:1.9.1-1:*:*:*:*:*:*:*"],"name":"libcommons-beanutils-java","purl":"pkg:deb/ubuntu/libcommons-beanutils-java@1.9.1-1?arch=all&distro=ubuntu-14.04&upstream=commons-beanutils","type":"deb","version":"1.9.1-1","language":"","licenses":["sha256:a0ea7d5d98f51289cfff265531219586cb2bfda54a9097301d781d531d522146"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcommons-beanutils-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libcommons-beanutils-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-beanutils-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-beanutils-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-beanutils-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-beanutils-java.list"}],"upstreams":[{"name":"commons-beanutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"commons-beanutils","version":"1.9.1-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-10086","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-10086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10086","date":"2026-11-02","epss":0.29082,"percentile":0.98163}],"risk":14.541,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-10086"},"relatedVulnerabilities":[{"id":"CVE-2019-10086","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10086","date":"2026-11-02","epss":0.29082,"percentile":0.98163}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html","http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e","https://access.redhat.com/errata/RHSA-2019:4317","https://access.redhat.com/errata/RHSA-2020:0057","https://access.redhat.com/errata/RHSA-2020:0194","https://access.redhat.com/errata/RHSA-2020:0804","https://access.redhat.com/errata/RHSA-2020:0805","https://access.redhat.com/errata/RHSA-2020:0806","https://access.redhat.com/errata/RHSA-2020:0811","https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E","https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10086","description":"In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-11-02","epss":0.4701,"percentile":0.98832}],"risk":14.102999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-11-02","epss":0.4701,"percentile":0.98832}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-11-02","epss":0.4701,"percentile":0.98832}],"risk":14.102999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-11-02","epss":0.4701,"percentile":0.98832}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-11-02","epss":0.27095,"percentile":0.9805}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.25.v20180606"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vgg8-72f2-qm23","versionConstraint":"<=9.2.25.v20180105 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vgg8-72f2-qm23","fix":{"state":"fixed","versions":["9.2.25.v20180606"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.2.25.v20180606"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7657","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2017-7657","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-7657","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7657","date":"2026-11-02","epss":0.14371,"percentile":0.96616}],"risk":13.508740000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-7657","https://access.redhat.com/errata/RHSA-2019:0910","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securitytracker.com/id/1041194"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vgg8-72f2-qm23","description":"Critical severity vulnerability that affects org.eclipse.jetty:jetty-server"},"relatedVulnerabilities":[{"id":"CVE-2017-7657","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7657","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2017-7657","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-7657","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7657","date":"2026-11-02","epss":0.14371,"percentile":0.96616}],"urls":["http://www.securitytracker.com/id/1041194","https://access.redhat.com/errata/RHSA-2019:0910","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7657","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request."}]},{"artifact":{"id":"fcac84f1a59528a1","cpes":["cpe:2.3:a:libyaml-snake-java:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake-java:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake_java:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake_java:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml-snake:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml_snake:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml:libyaml-snake-java:1.12-2:*:*:*:*:*:*:*","cpe:2.3:a:libyaml:libyaml_snake_java:1.12-2:*:*:*:*:*:*:*"],"name":"libyaml-snake-java","purl":"pkg:deb/ubuntu/libyaml-snake-java@1.12-2?arch=all&distro=ubuntu-14.04&upstream=snakeyaml","type":"deb","version":"1.12-2","language":"","licenses":["Apache-2.0","BSD","EPL-1.0","GPL-2","LGPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libyaml-snake-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libyaml-snake-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libyaml-snake-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libyaml-snake-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libyaml-snake-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libyaml-snake-java.list"}],"upstreams":[{"name":"snakeyaml"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-18640","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"snakeyaml","version":"1.12-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-18640","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-18640","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18640","date":"2026-11-02","epss":0.26723,"percentile":0.98028}],"risk":13.361500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-18640"},"relatedVulnerabilities":[{"id":"CVE-2017-18640","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-18640","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-18640","date":"2026-11-02","epss":0.26723,"percentile":0.98028}],"urls":["https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion","https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack","https://bitbucket.org/snakeyaml/snakeyaml/issues/377","https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes","https://lists.apache.org/thread.html/r1058e7646988394de6a3fd0857ea9b1ee0de14d7bb28fee5ff782457%40%3Ccommits.atlas.apache.org%3E","https://lists.apache.org/thread.html/r154090b871cf96d985b90864442d84eb027c72c94bc3f0a5727ba2d1%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r16ae4e529401b75a1f5aa462b272b31bf2a108236f882f06fddc14bc%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1703a402f30c8a2ee409f8c6f393e95a63f8c952cc9ee5bf9dd586dc%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r182e9cf6f3fb22b9be0cac4ff0685199741d2ab6e9a4e27a3693c224%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r191ceadb1b883357384981848dfa5235cb02a90070c553afbaf9b3d9%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r1aab47b48a757c70e40fc0bcb1fcf1a3951afa6a17aee7cd66cf79f8%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1dfac8b6a7097bcb4979402bbb6e2f8c36d0d9001e3018717eb22b7e%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r1ffce2ed3017e9964f03ad2c539d69e49144fc8e9bf772d641612f98%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r20350031c60a77b45e0eded33e9b3e9cb0cbfc5e24e1c63bf264df12%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r22ac2aa053b7d9c6b75a49db78125c9316499668d0f4a044f3402e2f%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r28c9009a48d52cf448f8b02cd823da0f8601d2dff4d66f387a35f1e0%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r2a5b84fdf59042dc398497e914b5bb1aed77328320b1438144ae1953%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r2b05744c0c2867daa5d1a96832965b7d6220328b0ead06c22a6e7854%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r2db207a2431a5e9e95e899858ab1f5eabd9bcc790a6ca7193ae07e94%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r436988d2cfe8a770ae361c82b181c5b2bf48a249bad84d8a55a3b46e%40%3Cdev.phoenix.apache.org%3E","https://lists.apache.org/thread.html/r465d2553a31265b042cf5457ef649b71e0722ab89b6ea94a5d59529b%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r4d7f37da1bc2df90a5a0f56eb7629b5ea131bfe11eeeb4b4c193f64a%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r5510f0125ba409fc1cabd098ab8b457741e5fa314cbd0e61e4339422%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r55d807f31e64a080c54455897c20b1667ec792e5915132c7b7750533%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r56805265475919252ba7fc10123f15b91097f3009bae86476624ca25%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r643ba53f002ae59068f9352fe1d82e1b6f375387ffb776f13efe8fda%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r666f29a7d0e1f98fa1425ca01efcfa86e6e3856e01d300828aa7c6ea%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r6c91e52b3cc9f4e64afe0f34f20507143fd1f756d12681a56a9b38da%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r6d54c2da792c74cc14b9b7665ea89e144c9e238ed478d37fd56292e6%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r72a3588d62b2de1361dc9648f5d355385735e47f7ba49d089b0e680d%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r7ce3de03facf7e7f3e24fc25d26d555818519dafdb20f29398a3414b%40%3Cdev.phoenix.apache.org%3E","https://lists.apache.org/thread.html/r8464b6ec951aace8c807bac9ea526d4f9e3116aa16d38be06f7c6524%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8b57c57cffa01e418868a3c7535b987635ff1fb5ab534203bfa2d64a%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/raebd2019b3da8c2f90f31e8b203b45353f78770ca93bfe5376f5532e%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb0e033d5ec8233360203431ad96580cf2ec56f47d9a425d894e279c2%40%3Cpr.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb34d8d3269ad47a1400f5a1a2d8310e13a80b6576ebd7f512144198d%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb5c33d0069c927fae16084f0605895b98d231d7c48527bcb822ac48c%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb7b28ac741e32dd5edb2c22485d635275bead7290b056ee56baf8ce0%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rbaa1f513d903c89a08267c91d86811fa5bcc82e0596b6142c5cea7ea%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rc3211c71f7e0973a1825d1988a3921288c06cd9d793eae97ecd34948%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcb2a7037366c58bac6aec6ce3df843a11ef97ae4eb049f05f410eaa5%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rcb4b61dbe2ed1c7a88781a9aff5a9e7342cc7ed026aec0418ee67596%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rce5c93bba6e815fb62ad38e28ca1943b3019af1eddeb06507ad4e11a%40%3Ccommits.atlas.apache.org%3E","https://lists.apache.org/thread.html/rd582c64f66c354240290072f340505f5d026ca944ec417226bb0272e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rdd34c0479587e32a656d976649409487d51ca0d296b3e26b6b89c3f5%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re791a854001ec1f79cd4f47328b270e7a1d9d7056debb8f16d962722%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/re851bbfbedd47c690b6e01942acb98ee08bd00df1a94910b905bc8cd%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/reb1751562ee5146d3aca654a2df76a2c13d8036645ce69946f9c219e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/recfe569f4f260328b0036f1c82b2956e864d519ab941a5e75d0d832d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rf95bebee6dfcc55067cebe8482bd31e6f481d9f74ba8e03f860c3ec7%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfe0aab6c3bebbd9cbfdedb65ff3fdf420714bcb8acdfd346077e1263%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKN7VGIKTYBCAKYBRG55QHXAY5UDZ7HA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6/","https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages","https://security.gentoo.org/glsa/202305-28","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564."}]},{"artifact":{"id":"4b54bb58d74f5e0c","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A7.4.052-1ubuntu3.1?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3.1","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.preinst"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-11-02","epss":0.26474,"percentile":0.98011}],"risk":13.236999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0572"},"relatedVulnerabilities":[{"id":"CVE-2022-0572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-11-02","epss":0.26474,"percentile":0.98011}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f","https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf","https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://support.apple.com/kb/HT213488","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0572","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2."}]},{"artifact":{"id":"a2ec081aadd3389e","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A7.4.052-1ubuntu3.1?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3.1","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-11-02","epss":0.26474,"percentile":0.98011}],"risk":13.236999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0572"},"relatedVulnerabilities":[{"id":"CVE-2022-0572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-11-02","epss":0.26474,"percentile":0.98011}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f","https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf","https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://support.apple.com/kb/HT213488","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0572","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2."}]},{"artifact":{"id":"44dda7f4925857f1","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/ubuntu/libnss3@2%3A3.28.4-0ubuntu0.14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=nss","type":"deb","version":"2:3.28.4-0ubuntu0.14.04.3","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-43527","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"nss","version":"2:3.28.4-0ubuntu0.14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-43527","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-43527","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43527","date":"2026-11-02","epss":0.17563,"percentile":0.9714}],"risk":13.172250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-43527"},"relatedVulnerabilities":[{"id":"CVE-2021-43527","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43527","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43527","date":"2026-11-02","epss":0.17563,"percentile":0.9714}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1737470","https://cert-portal.siemens.com/productcert/pdf/ssa-594438.pdf","https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/","https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/","https://security.gentoo.org/glsa/202212-05","https://security.netapp.com/advisory/ntap-20211229-0002/","https://www.mozilla.org/security/advisories/mfsa2021-51/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.starwindsoftware.com/security/sw-20220802-0001/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43527","description":"NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \\#7, or PKCS \\#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1."}]},{"artifact":{"id":"70f15653198a19ec","cpes":["cpe:2.3:a:libnss3-nssdb:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3-nssdb:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_nssdb:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3_nssdb:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3-nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libnss3:libnss3_nssdb:2\\:3.28.4-0ubuntu0.14.04.3:*:*:*:*:*:*:*"],"name":"libnss3-nssdb","purl":"pkg:deb/ubuntu/libnss3-nssdb@2%3A3.28.4-0ubuntu0.14.04.3?arch=all&distro=ubuntu-14.04&upstream=nss","type":"deb","version":"2:3.28.4-0ubuntu0.14.04.3","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3-nssdb/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnss3-nssdb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-nssdb.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3-nssdb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3-nssdb.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnss3-nssdb.list"}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-43527","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"nss","version":"2:3.28.4-0ubuntu0.14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-43527","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-43527","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43527","date":"2026-11-02","epss":0.17563,"percentile":0.9714}],"risk":13.172250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-43527"},"relatedVulnerabilities":[{"id":"CVE-2021-43527","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43527","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43527","date":"2026-11-02","epss":0.17563,"percentile":0.9714}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1737470","https://cert-portal.siemens.com/productcert/pdf/ssa-594438.pdf","https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/","https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/","https://security.gentoo.org/glsa/202212-05","https://security.netapp.com/advisory/ntap-20211229-0002/","https://www.mozilla.org/security/advisories/mfsa2021-51/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.starwindsoftware.com/security/sw-20220802-0001/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43527","description":"NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \\#7, or PKCS \\#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-11-02","epss":0.25666,"percentile":0.97965}],"risk":12.833,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-11-02","epss":0.25666,"percentile":0.97965}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-11-02","epss":0.25666,"percentile":0.97965}],"risk":12.833,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1350"},"relatedVulnerabilities":[{"id":"CVE-2019-1350","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1350","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1350","date":"2026-11-02","epss":0.25666,"percentile":0.97965}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30","https://security.gentoo.org/glsa/202003-42"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1350","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-11-02","epss":0.40736,"percentile":0.98653}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-11-02","epss":0.24014,"percentile":0.97843}],"risk":12.007,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-11-02","epss":0.24014,"percentile":0.97843}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-11-02","epss":0.24014,"percentile":0.97843}],"risk":12.007,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-11-02","epss":0.24014,"percentile":0.97843}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"risk":12.001000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-11-02","epss":0.24002,"percentile":0.97842}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"6e3b56fea883b624","cpes":["cpe:2.3:a:tar_project:tar:1.0.3:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:1.0.3:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:1.0.3:*:*:*:*:node.js:*:*"],"name":"tar","purl":"pkg:npm/tar@1.0.3","type":"npm","version":"1.0.3","language":"javascript","licenses":["BSD"],"locations":[{"path":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/node-gyp/node_modules/tar/package.json","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/node-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3jfq-g458-7qm9","versionConstraint":"<3.2.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"tar","version":"1.0.3"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3jfq-g458-7qm9","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2021-08-04","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-32804","date":"2026-11-02","epss":0.15067,"percentile":0.9673}],"risk":11.827594999999999,"urls":["https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-32804","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3jfq-g458-7qm9","description":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization"},"relatedVulnerabilities":[{"id":"CVE-2021-32804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-32804","date":"2026-11-02","epss":0.15067,"percentile":0.9673}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar."}]},{"artifact":{"id":"191fa3d525fd07ea","cpes":["cpe:2.3:a:tar_project:tar:2.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.1:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.1:*:*:*:*:node.js:*:*"],"name":"tar","purl":"pkg:npm/tar@2.2.1","type":"npm","version":"2.2.1","language":"javascript","licenses":["ISC"],"locations":[{"path":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/tar/package.json","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3jfq-g458-7qm9","versionConstraint":"<3.2.2 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"tar","version":"2.2.1"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-3jfq-g458-7qm9","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2021-08-04","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-32804","date":"2026-11-02","epss":0.15067,"percentile":0.9673}],"risk":11.827594999999999,"urls":["https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-32804","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3jfq-g458-7qm9","description":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization"},"relatedVulnerabilities":[{"id":"CVE-2021-32804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-32804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-32804","date":"2026-11-02","epss":0.15067,"percentile":0.9673}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-35737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-35737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-11-02","epss":0.23575,"percentile":0.97805}],"risk":11.7875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-35737"},"relatedVulnerabilities":[{"id":"CVE-2022-35737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-11-02","epss":0.23575,"percentile":0.97805}],"urls":["https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","https://kb.cert.org/vuls/id/720344","https://security.gentoo.org/glsa/202210-40","https://security.netapp.com/advisory/ntap-20220915-0009/","https://sqlite.org/releaselog/3_39_2.html","https://www.sqlite.org/cves.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API."}]},{"artifact":{"id":"3390fbc83cbe808e","cpes":["cpe:2.3:a:qs_project:qs:5.1.0:*:*:*:*:node.js:*:*"],"name":"qs","purl":"pkg:npm/qs@5.1.0","type":"npm","version":"5.1.0","language":"javascript","licenses":["BSD-3-Clause"],"locations":[{"path":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/request/node_modules/qs/package.json","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/request/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.2.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hrpp-h998-j3pp","versionConstraint":"<6.2.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"qs","version":"5.1.0"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-hrpp-h998-j3pp","fix":{"state":"fixed","versions":["6.2.4"],"available":[{"date":"2022-12-07","kind":"first-observed","version":"6.2.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-24999","date":"2026-11-02","epss":0.15695,"percentile":0.96859}],"risk":11.77125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hrpp-h998-j3pp","description":"qs vulnerable to Prototype Pollution"},"relatedVulnerabilities":[{"id":"CVE-2022-24999","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-24999","date":"2026-11-02","epss":0.15695,"percentile":0.96859}],"urls":["https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable)."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-11-02","epss":0.23509,"percentile":0.97799}],"risk":11.7545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4304"},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-11-02","epss":0.23509,"percentile":0.97799}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://cert-portal.siemens.com/productcert/html/ssa-203374.html","https://cert-portal.siemens.com/productcert/html/ssa-264814.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-11-02","epss":0.23509,"percentile":0.97799}],"risk":11.7545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4304"},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-11-02","epss":0.23509,"percentile":0.97799}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://cert-portal.siemens.com/productcert/html/ssa-203374.html","https://cert-portal.siemens.com/productcert/html/ssa-264814.html","https://cert-portal.siemens.com/productcert/html/ssa-337522.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html","https://cert-portal.siemens.com/productcert/html/ssa-625862.html","https://cert-portal.siemens.com/productcert/html/ssa-699386.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-879734.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10009","versionConstraint":"< 1:6.6p1-2ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10009","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.10"],"available":[{"date":"2018-01-22","kind":"advisory","version":"1:6.6p1-2ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-11-02","epss":0.37431,"percentile":0.9853}],"risk":11.229299999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10009"},"relatedVulnerabilities":[{"id":"CVE-2016-10009","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-11-02","epss":0.37431,"percentile":0.9853}],"urls":["http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html","http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2023/Jul/31","http://www.openwall.com/lists/oss-security/2016/12/19/2","http://www.openwall.com/lists/oss-security/2023/07/19/9","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.securityfocus.com/bid/94968","http://www.securitytracker.com/id/1037490","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637","https://access.redhat.com/errata/RHSA-2017:2029","https://bugs.chromium.org/p/project-zero/issues/detail?id=1009","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us","https://usn.ubuntu.com/3538-1/","https://www.exploit-db.com/exploits/40963/","https://www.openssh.com/txt/release-7.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","description":"Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket."}]},{"artifact":{"id":"bdc0cdec1fd8d2d8","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.10:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.10?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.10","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3518","date":"2026-11-02","epss":0.21859,"percentile":0.97646}],"risk":10.9295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3518"},"relatedVulnerabilities":[{"id":"CVE-2021-3518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3518","date":"2026-11-02","epss":0.21859,"percentile":0.97646}],"urls":["http://seclists.org/fulldisclosure/2021/Jul/54","http://seclists.org/fulldisclosure/2021/Jul/55","http://seclists.org/fulldisclosure/2021/Jul/58","http://seclists.org/fulldisclosure/2021/Jul/59","https://bugzilla.redhat.com/show_bug.cgi?id=1954242","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/","https://security.gentoo.org/glsa/202107-05","https://security.netapp.com/advisory/ntap-20210625-0002/","https://support.apple.com/kb/HT212601","https://support.apple.com/kb/HT212602","https://support.apple.com/kb/HT212604","https://support.apple.com/kb/HT212605","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3518","description":"There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability."}]},{"artifact":{"id":"03ebb4536717b3c2","cpes":["cpe:2.3:a:apt:apt:1.0.1ubuntu2.17:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@1.0.1ubuntu2.17?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1ubuntu2.17","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.17"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"ac779647782a976b","cpes":["cpe:2.3:a:apt-utils:apt-utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:apt-utils:apt_utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt-utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt_utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt-utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt_utils:1.0.1ubuntu2.17:*:*:*:*:*:*:*"],"name":"apt-utils","purl":"pkg:deb/ubuntu/apt-utils@1.0.1ubuntu2.17?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.17","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt-utils/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/apt-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/apt-utils.list"}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.17"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"c0a29ab518309763","cpes":["cpe:2.3:a:libapt-inst1.5:libapt-inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt-inst1.5:libapt_inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt-inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt_inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_inst1.5:1.0.1ubuntu2.17:*:*:*:*:*:*:*"],"name":"libapt-inst1.5","purl":"pkg:deb/ubuntu/libapt-inst1.5@1.0.1ubuntu2.17?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.17","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-inst1.5/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libapt-inst1.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.17"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"23912e832f78b3b2","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.1ubuntu2.17:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/ubuntu/libapt-pkg4.12@1.0.1ubuntu2.17?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.17","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.17"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-11-02","epss":0.14555,"percentile":0.96645}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"e532171bd23cf4a1","cpes":["cpe:2.3:a:mercurial:mercurial:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*"],"name":"mercurial","purl":"pkg:deb/ubuntu/mercurial@2.8.2-1ubuntu1.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.8.2-1ubuntu1.3","language":"","licenses":["sha256:70a5c499d8d126c157f869b97746607949adabc9acf37a282b52894941513e4d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mercurial/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/mercurial/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mercurial.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mercurial.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial.list"},{"path":"/var/lib/dpkg/info/mercurial.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial.postinst"},{"path":"/var/lib/dpkg/info/mercurial.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial.postrm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.2-1ubuntu1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-9462","versionConstraint":"< 2.8.2-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mercurial","version":"2.8.2-1ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9462","fix":{"state":"fixed","versions":["2.8.2-1ubuntu1.4"],"available":[{"date":"2017-06-06","kind":"advisory","version":"2.8.2-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9462","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9462","date":"2026-11-02","epss":0.21685,"percentile":0.97633}],"risk":10.8425,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9462"},"relatedVulnerabilities":[{"id":"CVE-2017-9462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9462","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9462","date":"2026-11-02","epss":0.21685,"percentile":0.97633}],"urls":["http://www.debian.org/security/2017/dsa-3963","http://www.securityfocus.com/bid/99123","https://access.redhat.com/errata/RHSA-2017:1576","https://bugs.debian.org/861243","https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html","https://security.gentoo.org/glsa/201709-18","https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499","https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9462","description":"In Mercurial before 4.1.3, \"hg serve --stdio\" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name."}]},{"artifact":{"id":"402f1bec54147ccd","cpes":["cpe:2.3:a:mercurial-common:mercurial-common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:mercurial-common:mercurial_common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:mercurial_common:mercurial-common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:mercurial_common:mercurial_common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:mercurial:mercurial-common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*","cpe:2.3:a:mercurial:mercurial_common:2.8.2-1ubuntu1.3:*:*:*:*:*:*:*"],"name":"mercurial-common","purl":"pkg:deb/ubuntu/mercurial-common@2.8.2-1ubuntu1.3?arch=all&distro=ubuntu-14.04&upstream=mercurial","type":"deb","version":"2.8.2-1ubuntu1.3","language":"","licenses":["sha256:70a5c499d8d126c157f869b97746607949adabc9acf37a282b52894941513e4d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mercurial-common/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/mercurial-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mercurial-common.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mercurial-common.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mercurial-common.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial-common.list"},{"path":"/var/lib/dpkg/info/mercurial-common.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial-common.postinst"},{"path":"/var/lib/dpkg/info/mercurial-common.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/mercurial-common.prerm"}],"upstreams":[{"name":"mercurial"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.2-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9462","versionConstraint":"< 2.8.2-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mercurial","version":"2.8.2-1ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9462","fix":{"state":"fixed","versions":["2.8.2-1ubuntu1.4"],"available":[{"date":"2017-06-06","kind":"advisory","version":"2.8.2-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9462","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9462","date":"2026-11-02","epss":0.21685,"percentile":0.97633}],"risk":10.8425,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9462"},"relatedVulnerabilities":[{"id":"CVE-2017-9462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9462","cwe":"CWE-732","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9462","date":"2026-11-02","epss":0.21685,"percentile":0.97633}],"urls":["http://www.debian.org/security/2017/dsa-3963","http://www.securityfocus.com/bid/99123","https://access.redhat.com/errata/RHSA-2017:1576","https://bugs.debian.org/861243","https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html","https://security.gentoo.org/glsa/201709-18","https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499","https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9462","description":"In Mercurial before 4.1.3, \"hg serve --stdio\" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-11-02","epss":0.20459,"percentile":0.97505}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-11-02","epss":0.34007,"percentile":0.98397}],"risk":10.202099999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-11-02","epss":0.34007,"percentile":0.98397}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-11-02","epss":0.34007,"percentile":0.98397}],"risk":10.202099999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-11-02","epss":0.34007,"percentile":0.98397}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1336","versionConstraint":"< 7.0.52-1ubuntu0.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1336","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.15"],"available":[{"date":"2018-07-25","kind":"advisory","version":"7.0.52-1ubuntu0.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1336","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1336","date":"2026-11-02","epss":0.20354,"percentile":0.97487}],"risk":10.177,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1336"},"relatedVulnerabilities":[{"id":"CVE-2018-1336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1336","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1336","date":"2026-11-02","epss":0.20354,"percentile":0.97487}],"urls":["http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E","http://www.securityfocus.com/bid/104898","http://www.securitytracker.com/id/1041375","https://access.redhat.com/errata/RHEA-2018:2188","https://access.redhat.com/errata/RHEA-2018:2189","https://access.redhat.com/errata/RHSA-2018:2700","https://access.redhat.com/errata/RHSA-2018:2701","https://access.redhat.com/errata/RHSA-2018:2740","https://access.redhat.com/errata/RHSA-2018:2741","https://access.redhat.com/errata/RHSA-2018:2742","https://access.redhat.com/errata/RHSA-2018:2743","https://access.redhat.com/errata/RHSA-2018:2921","https://access.redhat.com/errata/RHSA-2018:2930","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:2945","https://access.redhat.com/errata/RHSA-2018:3768","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html","https://security.netapp.com/advisory/ntap-20180817-0001/","https://support.f5.com/csp/article/K73008537?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3723-1/","https://www.debian.org/security/2018/dsa-4281","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1336","description":"An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86."}]},{"artifact":{"id":"4cc0d756033f0575","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5733","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5733","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-11-02","epss":0.20242,"percentile":0.97469}],"risk":10.120999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5733"},"relatedVulnerabilities":[{"id":"CVE-2018-5733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-11-02","epss":0.20242,"percentile":0.97469}],"urls":["http://www.securityfocus.com/bid/103188","http://www.securitytracker.com/id/1040437","https://access.redhat.com/errata/RHSA-2018:0469","https://access.redhat.com/errata/RHSA-2018:0483","https://kb.isc.org/docs/aa-01567","https://lists.debian.org/debian-lts-announce/2018/03/msg00015.html","https://usn.ubuntu.com/3586-1/","https://usn.ubuntu.com/3586-2/","https://www.debian.org/security/2018/dsa-4133","https://security.netapp.com/advisory/ntap-20250425-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5733","description":"A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0."}]},{"artifact":{"id":"882b065c3207d168","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.10:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.10?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.10","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5733","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5733","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-11-02","epss":0.20242,"percentile":0.97469}],"risk":10.120999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5733"},"relatedVulnerabilities":[{"id":"CVE-2018-5733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-11-02","epss":0.20242,"percentile":0.97469}],"urls":["http://www.securityfocus.com/bid/103188","http://www.securitytracker.com/id/1040437","https://access.redhat.com/errata/RHSA-2018:0469","https://access.redhat.com/errata/RHSA-2018:0483","https://kb.isc.org/docs/aa-01567","https://lists.debian.org/debian-lts-announce/2018/03/msg00015.html","https://usn.ubuntu.com/3586-1/","https://usn.ubuntu.com/3586-2/","https://www.debian.org/security/2018/dsa-4133","https://security.netapp.com/advisory/ntap-20250425-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5733","description":"A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"risk":10.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-11-02","epss":0.20217,"percentile":0.97465}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-11-02","epss":0.20126,"percentile":0.97454}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"a6fcde16b943ffcb","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"eca63cdd4d65e2ef","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"a962637344871aaa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"1a80ece3627ef154","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"556cca2eb09fbcff","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-11-02","epss":0.13368,"percentile":0.96417}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-51385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-51385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-11-02","epss":0.19753,"percentile":0.97404}],"risk":9.8765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-51385"},"relatedVulnerabilities":[{"id":"CVE-2023-51385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-11-02","epss":0.19753,"percentile":0.97404}],"urls":["http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/26/4","https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0005/","https://support.apple.com/kb/HT214084","https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html","https://www.debian.org/security/2023/dsa-5586","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","http://www.openwall.com/lists/oss-security/2025/10/07/1","http://www.openwall.com/lists/oss-security/2025/10/12/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-51385","description":"In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name."}]},{"artifact":{"id":"43b18cd631916f9e","cpes":["cpe:2.3:a:klibc-utils:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc-utils:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc-utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc_utils:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*"],"name":"klibc-utils","purl":"pkg:deb/ubuntu/klibc-utils@2.0.3-0ubuntu1.14.04.2?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.2","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/klibc-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.list"},{"path":"/var/lib/dpkg/info/klibc-utils.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/klibc-utils.postinst"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"risk":9.6215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"01c2d3b342249ec1","cpes":["cpe:2.3:a:libklibc:libklibc:2.0.3-0ubuntu1.14.04.2:*:*:*:*:*:*:*"],"name":"libklibc","purl":"pkg:deb/ubuntu/libklibc@2.0.3-0ubuntu1.14.04.2?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.2","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libklibc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libklibc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libklibc.list"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"risk":9.6215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"a1d1894adfb63c2e","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-1ubuntu1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.8.dfsg-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=zlib","type":"deb","version":"1:1.2.8.dfsg-1ubuntu1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"risk":9.6215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-11-02","epss":0.19243,"percentile":0.97333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"4ced6a17da239544","cpes":["cpe:2.3:a:libnetty-java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty-java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*"],"name":"libnetty-java","purl":"pkg:deb/ubuntu/libnetty-java@1%3A3.2.6.Final-2?arch=all&distro=ubuntu-14.04&upstream=netty","type":"deb","version":"1:3.2.6.Final-2","language":"","licenses":["sha256:637e6b5538594243e93cd1a7c7516fa6c55bc4d6a304434915fa623e69d0156f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.list"}],"upstreams":[{"name":"netty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-21295","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"netty","version":"1:3.2.6.Final-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-21295","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-21295","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21295","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21295","date":"2026-11-02","epss":0.18891,"percentile":0.97292}],"risk":9.4455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-21295"},"relatedVulnerabilities":[{"id":"CVE-2021-21295","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21295","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-21295","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21295","date":"2026-11-02","epss":0.18891,"percentile":0.97292}],"urls":["https://github.com/Netflix/zuul/pull/980","https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4","https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj","https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r040a5e4d9cca2f98354b58a70b27099672276f66995c4e2e39545d0b%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r04a3e0d9f53421fb946c60cc54762b7151dc692eb4e39970a7579052%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r0b09f3e31e004fe583f677f7afa46bd30110904576c13c5ac818ac2c%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r15f66ada9a5faf4bac69d9e7c4521cedfefa62df9509881603791969%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r16c4b55ac82be72f28adad4f8061477e5f978199d5725691dcc82c24%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1bca0b81193b74a451fc6d687ab58ef3a1f5ec40f6c61561d8dd9509%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r22adb45fe902aeafcd0a1c4db13984224a667676c323c66db3af38a1%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r22b2f34447d71c9a0ad9079b7860323d5584fb9b40eb42668c21eaf1%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r268850f26639ebe249356ed6d8edb54ee8943be6f200f770784fb190%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r27b7e5a588ec826b15f38c40be500c50073400019ce7b8adfd07fece%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2e93ce23e04c3f0a61e987d1111d0695cb668ac4ec4edbf237bd3e80%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r312ce5bd3c6bf08c138349b507b6f1c25fe9cf40b6f2b0014c9d12b1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r393a339ab0b63ef9e6502253eeab26e7643b3e69738d5948b2b1d064%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r3c293431c781696681abbfe1c573c2d9dcdae6fd3ff330ea22f0433f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3c4596b9b37f5ae91628ccf169d33cd5a0da4b16b6c39d5bad8e03f3%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r3ff9e735ca33612d900607dc139ebd38a64cadc6bce292e53eb86d7f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r490ca5611c150d193b320a2608209180713b7c68e501b67b0cffb925%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r4ea2f1a9d79d4fc1896e085f31fb60a21b1770d0a26a5250f849372d%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/r5232e33a1f3b310a3e083423f736f3925ebdb150844d60ac582809f8%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5470456cf1409a99893ae9dd57439799f6dc1a60fda90e11570f66fe%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r57245853c7245baab09eae08728c52b58fd77666538092389cc3e882%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5fc5786cdd640b1b0a3c643237ce0011f0a08a296b11c0e2c669022c%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r602e98daacc98934f097f07f2eed6eb07c18bfc1949c8489dc7bfcf5%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67e6a636cbc1958383a1cd72b7fd0cd7493360b1dd0e6c12f5761798%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6a122c25e352eb134d01e7f4fc4d345a491c5ee9453fef6fc754d15b%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6a29316d758db628a1df49ca219d64caf493999b52cc77847bfba675%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6aee7e3566cb3e51eeed2fd8786704d91f80a7581e00a787ba9f37f6%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r6d32fc3cd547f7c9a288a57c7f525f5d00a00d5d163613e0d10a23ef%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r70cebada51bc6d49138272437d8a28fe971d0197334ef906b575044c%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r837bbcbf12e335e83ab448b1bd2c1ad7e86efdc14034b23811422e6a%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r855b4b6814ac829ce2d48dd9d8138d07f33387e710de798ee92c011e%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r86cd38a825ab2344f3e6cad570528852f29a4ffdf56ab67d75c36edf%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r8bcaf7821247b1836b10f6a1a3a3212b06272fd4cde4a859de1b78cf%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/r8db1d7b3b9acc9e8d2776395e280eb9615dd7790e1da8c57039963de%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9051e4f484a970b5566dc1870ecd9c1eb435214e2652cf3ea4d0c0cc%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r905b92099998291956eebf4f1c5d95f5a0cbcece2946cc46d32274fd%40%3Cdev.hbase.apache.org%3E","https://lists.apache.org/thread.html/r96ce18044880c33634c4b3fcecc57b8b90673c9364d63eba00385523%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a683389123f898%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/ra655e5cec74d1ddf62adacb71d398abd96f3ea2c588f6bbf048348eb%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/ra83096bcbfe6e1f4d54449f8a013117a0536404e9d307ab4a0d34f81%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ra96c74c37ed7252f78392e1ad16442bd16ae72a4d6c8db50dd55c88b%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/racc191a1f70a4f13155e8002c61bddef2870b26441971c697436ad5d%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rae198f44c3f7ac5264045e6ba976be1703cff38dcf1609916e50210d%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb523bb6c60196c5f58514b86a8585c2069a4852039b45de3818b29d2%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb95d42ce220ed4a4683aa17833b5006d657bc4254bc5cb03cd5e6bfb%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rbadcbcb50195f00bbd196403865ced521ca70787999583c07be38d0e%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbed09768f496244a2e138dbbe6d2847ddf796c9c8ef9e50f2e3e30d9%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc165e36ca7cb5417aec3f21bbc4ec00fb38ecebdd96a82cfab9bd56f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc73b8dd01b1be276d06bdf07883ecd93fe1a01f139a99ef30ba4308c%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rca0978b634a0c3ebee4126ec29c7f570b165fae3f8f3658754c1cbd3%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rcf3752209a8b04996373bf57fdc808b3bfaa2be8702698a0323641f8%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/rcfc154eb2de23d2dc08a56100341161e1a40a8ea86c693735437e8f2%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rcfc535afd413d9934d6ee509dce234dac41fa3747a7555befb17447e%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd25c88aad0e76240dd09f0eb34bdab924933946429e068a167adcb73%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rd4a6b7dec38ea6cd28b6f94bd4b312629a52b80be3786d5fb0e474bc%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rdb4db3f5a9c478ca52a7b164680b88877a5a9c174e7047676c006b2c%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rdc096e13ac4501ea2e2b03a197682a313b85d3d3ec89d5ae5551b384%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re4f70b62843e92163fab03b65e2aa8078693293a0c36f1cc260079ed%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/re6207ebe2ca4d44f2a6deee695ad6f27fd29d78980f1d46ed1574f91%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/reafc834062486adfc7be5bb8f7b7793be0d33f483678a094c3f9d468%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf87b870a22aa5c77c27900967b518a71a7d954c2952860fce3794b60%40%3Ccommits.servicecomb.apache.org%3E","https://lists.apache.org/thread.html/rf934292a4a1c189827f625d567838d2c1001e4739b158638d844105b%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20210604-0003/","https://www.debian.org/security/2021/dsa-4885","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21295","description":"Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`."}]},{"artifact":{"id":"854d0a32aa5f8b1e","cpes":["cpe:2.3:a:apache:httpclient:4.2.5:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.5","type":"java-archive","version":"4.2.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/usr/share/java/wagon-http-shaded-2.x.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/usr/share/java/wagon-http-shaded-2.x.jar","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/java/wagon-http-shaded-2.x.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-11-02","epss":0.1876,"percentile":0.97275}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-11-02","epss":0.1876,"percentile":0.97275}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"5b22ae430d4ac760","cpes":["cpe:2.3:a:libhttpclient-java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient-java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*"],"name":"libhttpclient-java","purl":"pkg:deb/ubuntu/libhttpclient-java@4.3.3-1?arch=all&distro=ubuntu-14.04&upstream=httpcomponents-client","type":"deb","version":"4.3.3-1","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libhttpclient-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libhttpclient-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.list"}],"upstreams":[{"name":"httpcomponents-client"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"httpcomponents-client","version":"4.3.3-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-11-02","epss":0.1876,"percentile":0.97275}],"risk":9.379999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5262"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-11-02","epss":0.1876,"percentile":0.97275}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.24"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1f-1ubuntu2.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.24"],"available":[{"date":"2018-03-28","kind":"advisory","version":"1.0.1f-1ubuntu2.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-11-02","epss":0.18596,"percentile":0.97256}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-11-02","epss":0.18596,"percentile":0.97256}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1f-1ubuntu2.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.24"],"available":[{"date":"2018-03-28","kind":"advisory","version":"1.0.1f-1ubuntu2.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-11-02","epss":0.18596,"percentile":0.97256}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-11-02","epss":0.18596,"percentile":0.97256}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"dba47ceadd4198eb","cpes":["cpe:2.3:a:libbatik-java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik-java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*"],"name":"libbatik-java","purl":"pkg:deb/ubuntu/libbatik-java@1.7.ubuntu-8ubuntu2.14.04.2?arch=all&distro=ubuntu-14.04&upstream=batik","type":"deb","version":"1.7.ubuntu-8ubuntu2.14.04.2","language":"","licenses":["sha256:5f184f3d7c36b1936ca4b863891979662da999f1d694d0ac22b078e77173af51"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbatik-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libbatik-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.list"}],"upstreams":[{"name":"batik"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.7.ubuntu-8ubuntu2.14.04.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-8013","versionConstraint":"< 1.7.ubuntu-8ubuntu2.14.04.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"batik","version":"1.7.ubuntu-8ubuntu2.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-8013","fix":{"state":"fixed","versions":["1.7.ubuntu-8ubuntu2.14.04.3"],"available":[{"date":"2018-05-29","kind":"advisory","version":"1.7.ubuntu-8ubuntu2.14.04.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-8013","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8013","date":"2026-11-02","epss":0.18591,"percentile":0.97255}],"risk":9.295499999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-8013"},"relatedVulnerabilities":[{"id":"CVE-2018-8013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8013","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8013","date":"2026-11-02","epss":0.18591,"percentile":0.97255}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104252","http://www.securitytracker.com/id/1040995","https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44%40%3Ccommits.xmlgraphics.apache.org%3E","https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19%40%3Ccommits.xmlgraphics.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00016.html","https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%3c000701d3f28f%24d01860a0%24704921e0%24%40gmail.com%3e","https://security.gentoo.org/glsa/202401-11","https://usn.ubuntu.com/3661-1/","https://www.debian.org/security/2018/dsa-4215","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://xmlgraphics.apache.org/security.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8013","description":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization."}]},{"artifact":{"id":"abad14c14eda1d93","cpes":["cpe:2.3:a:unzip:unzip:6.0-9ubuntu1.5:*:*:*:*:*:*:*"],"name":"unzip","purl":"pkg:deb/ubuntu/unzip@6.0-9ubuntu1.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"6.0-9ubuntu1.5","language":"","licenses":["sha256:ba1ff265de5038fef89cb5baafcec63547b230faf34b6d7efe1c21242ee82999"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/unzip/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/unzip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unzip.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/unzip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unzip.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/unzip.list"},{"path":"/var/lib/dpkg/info/unzip.postinst","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/unzip.postinst"},{"path":"/var/lib/dpkg/info/unzip.postrm","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/unzip.postrm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"unzip","version":"6.0-9ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000035","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000035","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000035","date":"2026-11-02","epss":0.30066,"percentile":0.9821}],"risk":9.019799999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000035"},"relatedVulnerabilities":[{"id":"CVE-2018-1000035","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000035","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000035","date":"2026-11-02","epss":0.30066,"percentile":0.9821}],"urls":["https://lists.debian.org/debian-lts-announce/2020/01/msg00026.html","https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html","https://security.gentoo.org/glsa/202003-58"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2698","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2698","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2698","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-2698","fix":{"state":"fixed","versions":["1.7.0_221","7.0.221","1.8.0_211","8.0.211"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_221"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_211"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.221"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.211"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2698","date":"2026-11-02","epss":0.12013,"percentile":0.96132}],"risk":8.9797175,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2698","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-11-02","epss":0.17939,"percentile":0.97182}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0075","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0075","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2014-05-31","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0075","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0075","date":"2026-11-02","epss":0.17577,"percentile":0.97143}],"risk":8.7885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0075"},"relatedVulnerabilities":[{"id":"CVE-2014-0075","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0075","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0075","date":"2026-11-02","epss":0.17577,"percentile":0.97143}],"urls":["http://advisories.mageia.org/MGASA-2014-0268.html","http://linux.oracle.com/errata/ELSA-2014-0865.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html","http://marc.info/?l=bugtraq&m=141017844705317&w=2","http://marc.info/?l=bugtraq&m=141390017113542&w=2","http://marc.info/?l=bugtraq&m=144498216801440&w=2","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://seclists.org/fulldisclosure/2014/Dec/23","http://secunia.com/advisories/59121","http://secunia.com/advisories/59616","http://secunia.com/advisories/59678","http://secunia.com/advisories/59732","http://secunia.com/advisories/59835","http://secunia.com/advisories/59849","http://secunia.com/advisories/59873","http://secunia.com/advisories/60729","http://secunia.com/advisories/60793","http://svn.apache.org/viewvc?view=revision&revision=1578337","http://svn.apache.org/viewvc?view=revision&revision=1578341","http://svn.apache.org/viewvc?view=revision&revision=1579262","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www-01.ibm.com/support/docview.wss?uid=swg21678231","http://www-01.ibm.com/support/docview.wss?uid=swg21680603","http://www-01.ibm.com/support/docview.wss?uid=swg21681528","http://www.debian.org/security/2016/dsa-3447","http://www.debian.org/security/2016/dsa-3530","http://www.mandriva.com/security/advisories?name=MDVSA-2015:052","http://www.mandriva.com/security/advisories?name=MDVSA-2015:053","http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","http://www.novell.com/support/kb/doc.php?id=7010166","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","http://www.securityfocus.com/archive/1/534161/100/0/threaded","http://www.securityfocus.com/bid/67671","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0075","description":"Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2697","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2697","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_211"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-2697","versionConstraint":"< 1.7.0_221||>= 1.8, < 1.8.0_211||>= 7, < 7.0.221||>= 8, < 8.0.211 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-2697","fix":{"state":"fixed","versions":["1.7.0_221","7.0.221","1.8.0_211","8.0.211"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_221"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_211"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.221"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.211"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2697","date":"2026-11-02","epss":0.11466,"percentile":0.96013}],"risk":8.570834999999999,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-11-02","epss":0.17139,"percentile":0.97088}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-11-02","epss":0.17139,"percentile":0.97088}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-11-02","epss":0.17139,"percentile":0.97088}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-11-02","epss":0.17139,"percentile":0.97088}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1304","versionConstraint":"< 7.0.52-1ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1304","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.14"],"available":[{"date":"2018-05-30","kind":"advisory","version":"7.0.52-1ubuntu0.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1304","date":"2026-11-02","epss":0.1707,"percentile":0.9708}],"risk":8.535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1304"},"relatedVulnerabilities":[{"id":"CVE-2018-1304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1304","date":"2026-11-02","epss":0.1707,"percentile":0.9708}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103170","http://www.securitytracker.com/id/1040427","https://access.redhat.com/errata/RHSA-2018:0465","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://security.netapp.com/advisory/ntap-20180706-0001/","https://usn.ubuntu.com/3665-1/","https://www.debian.org/security/2018/dsa-4281","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1304","description":"The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected."}]},{"artifact":{"id":"bdc0cdec1fd8d2d8","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.10:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.10?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.10","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3517","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3517","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3517","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3517","date":"2026-11-02","epss":0.16986,"percentile":0.9707}],"risk":8.493,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3517"},"relatedVulnerabilities":[{"id":"CVE-2021-3517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3517","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3517","date":"2026-11-02","epss":0.16986,"percentile":0.9707}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1954232","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/","https://security.gentoo.org/glsa/202107-05","https://security.netapp.com/advisory/ntap-20210625-0002/","https://security.netapp.com/advisory/ntap-20211022-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3517","description":"There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5647","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5647","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5647","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5647","date":"2026-11-02","epss":0.1684,"percentile":0.97045}],"risk":8.42,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5647"},"relatedVulnerabilities":[{"id":"CVE-2017-5647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5647","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5647","date":"2026-11-02","epss":0.1684,"percentile":0.97045}],"urls":["http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt","http://www.debian.org/security/2017/dsa-3842","http://www.debian.org/security/2017/dsa-3843","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.securitytracker.com/id/1038218","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://access.redhat.com/errata/RHSA-2017:3080","https://access.redhat.com/errata/RHSA-2017:3081","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03730en_us","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5647","versionConstraint":"< 7.0.52-1ubuntu0.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5647","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.13"],"available":[{"date":"2018-01-08","kind":"advisory","version":"7.0.52-1ubuntu0.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5647","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5647","date":"2026-11-02","epss":0.1684,"percentile":0.97045}],"risk":8.42,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5647"},"relatedVulnerabilities":[{"id":"CVE-2017-5647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5647","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5647","date":"2026-11-02","epss":0.1684,"percentile":0.97045}],"urls":["http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt","http://www.debian.org/security/2017/dsa-3842","http://www.debian.org/security/2017/dsa-3843","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.securitytracker.com/id/1038218","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://access.redhat.com/errata/RHSA-2017:3080","https://access.redhat.com/errata/RHSA-2017:3081","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03730en_us","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5664","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5664","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-5664","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5664","date":"2026-11-02","epss":0.16567,"percentile":0.9701}],"risk":8.2835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5664"},"relatedVulnerabilities":[{"id":"CVE-2017-5664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5664","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5664","date":"2026-11-02","epss":0.16567,"percentile":0.9701}],"urls":["http://www.debian.org/security/2017/dsa-3891","http://www.debian.org/security/2017/dsa-3892","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/98888","http://www.securitytracker.com/id/1038641","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3080","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20171019-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5664","description":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5664","versionConstraint":"< 7.0.52-1ubuntu0.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5664","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.13"],"available":[{"date":"2018-01-08","kind":"advisory","version":"7.0.52-1ubuntu0.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5664","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5664","date":"2026-11-02","epss":0.16567,"percentile":0.9701}],"risk":8.2835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5664"},"relatedVulnerabilities":[{"id":"CVE-2017-5664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5664","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5664","date":"2026-11-02","epss":0.16567,"percentile":0.9701}],"urls":["http://www.debian.org/security/2017/dsa-3891","http://www.debian.org/security/2017/dsa-3892","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/98888","http://www.securitytracker.com/id/1038641","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3080","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20171019-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5664","description":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method."}]},{"artifact":{"id":"9d70263f1a572cdb","cpes":["cpe:2.3:a:wget:wget:1.15-1ubuntu1.14.04.3:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.15-1ubuntu1.14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.15-1ubuntu1.14.04.3","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:e73aa3873eb183784d9d5beffd04a5aa617a8e07a39c2110c7d113ca613783c2","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:e73aa3873eb183784d9d5beffd04a5aa617a8e07a39c2110c7d113ca613783c2","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:e73aa3873eb183784d9d5beffd04a5aa617a8e07a39c2110c7d113ca613783c2","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:e73aa3873eb183784d9d5beffd04a5aa617a8e07a39c2110c7d113ca613783c2","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.15-1ubuntu1.14.04.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0494","versionConstraint":"< 1.15-1ubuntu1.14.04.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"wget","version":"1.15-1ubuntu1.14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0494","fix":{"state":"fixed","versions":["1.15-1ubuntu1.14.04.4"],"available":[{"date":"2018-05-09","kind":"advisory","version":"1.15-1ubuntu1.14.04.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0494","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0494","date":"2026-11-02","epss":0.16488,"percentile":0.9699}],"risk":8.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0494"},"relatedVulnerabilities":[{"id":"CVE-2018-0494","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0494","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0494","date":"2026-11-02","epss":0.16488,"percentile":0.9699}],"urls":["http://www.securityfocus.com/bid/104129","http://www.securitytracker.com/id/1040838","https://access.redhat.com/errata/RHSA-2018:3052","https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd","https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html","https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html","https://savannah.gnu.org/bugs/?53763","https://security.gentoo.org/glsa/201806-01","https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt","https://usn.ubuntu.com/3643-1/","https://usn.ubuntu.com/3643-2/","https://www.debian.org/security/2018/dsa-4195","https://www.exploit-db.com/exploits/44601/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line."}]},{"artifact":{"id":"b37dbcb586168da6","cpes":["cpe:2.3:a:busybox-initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox-initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*"],"name":"busybox-initramfs","purl":"pkg:deb/ubuntu/busybox-initramfs@1%3A1.21.0-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=busybox","type":"deb","version":"1:1.21.0-1ubuntu1","language":"","licenses":["sha256:336d995e819d3a7a3fdbf3f5041c07094f75ee849acb3bb742b7503d45786329"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/busybox-initramfs/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/busybox-initramfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/busybox-initramfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/busybox-initramfs.list"}],"upstreams":[{"name":"busybox"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.21.0-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2148","versionConstraint":"< 1:1.21.0-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"busybox","version":"1:1.21.0-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2148","fix":{"state":"fixed","versions":["1:1.21.0-1ubuntu1.4"],"available":[{"date":"2019-04-03","kind":"advisory","version":"1:1.21.0-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2148","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2148","date":"2026-11-02","epss":0.27111,"percentile":0.98051}],"risk":8.1333,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2148"},"relatedVulnerabilities":[{"id":"CVE-2016-2148","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2148","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2148","date":"2026-11-02","epss":0.27111,"percentile":0.98051}],"urls":["http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://seclists.org/fulldisclosure/2020/Aug/20","http://www.openwall.com/lists/oss-security/2016/03/11/16","https://busybox.net/news.html","https://git.busybox.net/busybox/commit/?id=352f79acbd759c14399e39baef21fc4ffe180ac2","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201612-04","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2148","description":"Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35559","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35559","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35559","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35559","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13","17.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35559","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35559","date":"2026-11-02","epss":0.159,"percentile":0.96891}],"risk":8.109000000000002,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-5000","https://www.debian.org/security/2021/dsa-5012","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35559","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u151-2.6.11-2ubuntu0.14.04.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10355","versionConstraint":"< 7u151-2.6.11-2ubuntu0.14.04.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-10355","fix":{"state":"fixed","versions":["7u151-2.6.11-2ubuntu0.14.04.1"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7u151-2.6.11-2ubuntu0.14.04.1"}]},"cvss":[],"epss":[{"cve":"CVE-2017-10355","date":"2026-11-02","epss":0.16181,"percentile":0.96936}],"risk":8.0905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-10355"},"relatedVulnerabilities":[{"id":"CVE-2017-10355","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-10355","date":"2026-11-02","epss":0.16181,"percentile":0.96936}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/101369","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:2998","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3264","https://access.redhat.com/errata/RHSA-2017:3267","https://access.redhat.com/errata/RHSA-2017:3268","https://access.redhat.com/errata/RHSA-2017:3392","https://access.redhat.com/errata/RHSA-2017:3453","https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html","https://security.gentoo.org/glsa/201710-31","https://security.gentoo.org/glsa/201711-14","https://security.netapp.com/advisory/ntap-20171019-0001/","https://www.debian.org/security/2017/dsa-4015","https://www.debian.org/security/2017/dsa-4048"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10355","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u151-2.6.11-2ubuntu0.14.04.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10355","versionConstraint":"< 7u151-2.6.11-2ubuntu0.14.04.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-10355","fix":{"state":"fixed","versions":["7u151-2.6.11-2ubuntu0.14.04.1"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7u151-2.6.11-2ubuntu0.14.04.1"}]},"cvss":[],"epss":[{"cve":"CVE-2017-10355","date":"2026-11-02","epss":0.16181,"percentile":0.96936}],"risk":8.0905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-10355"},"relatedVulnerabilities":[{"id":"CVE-2017-10355","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-10355","date":"2026-11-02","epss":0.16181,"percentile":0.96936}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/101369","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:2998","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3264","https://access.redhat.com/errata/RHSA-2017:3267","https://access.redhat.com/errata/RHSA-2017:3268","https://access.redhat.com/errata/RHSA-2017:3392","https://access.redhat.com/errata/RHSA-2017:3453","https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html","https://security.gentoo.org/glsa/201710-31","https://security.gentoo.org/glsa/201711-14","https://security.netapp.com/advisory/ntap-20171019-0001/","https://www.debian.org/security/2017/dsa-4015","https://www.debian.org/security/2017/dsa-4048"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10355","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-8745","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8745","date":"2026-11-02","epss":0.16038,"percentile":0.96915}],"risk":8.019,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8745"},"relatedVulnerabilities":[{"id":"CVE-2016-8745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8745","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8745","date":"2026-11-02","epss":0.16038,"percentile":0.96915}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2017/dsa-3754","http://www.debian.org/security/2017/dsa-3755","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94828","http://www.securitytracker.com/id/1037432","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180607-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8745","description":"A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2017-3732","versionConstraint":">= 4.2.0, < 4.7.3||>= 6.9.0, < 6.9.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-3732","fix":{"state":"fixed","versions":["4.7.3","6.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.7.3"},{"date":"2025-09-04","kind":"first-observed","version":"6.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3732","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3732","date":"2026-11-02","epss":0.154,"percentile":0.96787}],"risk":7.777000000000001,"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95814","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://access.redhat.com/errata/RHSA-2018:2568","https://access.redhat.com/errata/RHSA-2018:2575","https://access.redhat.com/errata/RHSA-2018:2713","https://github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3732","description":"There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.6.1"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-5180","versionConstraint":">= 0.10.0, < 0.10.48||>= 0.12.0, < 0.12.17||>= 4.0.0, < 4.6.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-5180","fix":{"state":"fixed","versions":["0.10.48","0.12.17","4.6.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"0.10.48"},{"date":"2025-09-04","kind":"first-observed","version":"0.12.17"},{"date":"2025-09-04","kind":"first-observed","version":"4.6.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5180","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5180","date":"2026-11-02","epss":0.08583,"percentile":0.95076}],"risk":7.5744975000000005,"urls":["http://rhn.redhat.com/errata/RHSA-2017-0002.html","http://www.debian.org/security/2016/dsa-3682","http://www.securityfocus.com/bid/93243","http://www.ubuntu.com/usn/USN-3143-1","https://c-ares.haxx.se/CVE-2016-5180.patch","https://c-ares.haxx.se/adv_20160929.html","https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html","https://security.gentoo.org/glsa/201701-28","https://source.android.com/security/bulletin/2017-01-01.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 1.7.0_181||>= 1.8, < 1.8.0_171||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 1.7.0_181||>= 1.8, < 1.8.0_171||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 1.7.0_181||>= 1.8, < 1.8.0_171||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2799","fix":{"state":"fixed","versions":["1.7.0_181","7.0.181","1.8.0_171","8.0.171","10.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2799","date":"2026-11-02","epss":0.14771,"percentile":0.96681}],"risk":7.496282500000001,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103872","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E","https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3E","https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3E","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2799","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"c0fc697d6f7b9986","cpes":["cpe:2.3:a:libtiff5:libtiff5:4.0.3-7ubuntu0.7:*:*:*:*:*:*:*"],"name":"libtiff5","purl":"pkg:deb/ubuntu/libtiff5@4.0.3-7ubuntu0.7?arch=amd64&distro=ubuntu-14.04&upstream=tiff","type":"deb","version":"4.0.3-7ubuntu0.7","language":"","licenses":["sha256:af0acd0969682339cb3d81dd24ec0b6c91d6d9c671619e390c6381cd6a3faa5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff5/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libtiff5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.3-7ubuntu0.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18557","versionConstraint":"< 4.0.3-7ubuntu0.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tiff","version":"4.0.3-7ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18557","fix":{"state":"fixed","versions":["4.0.3-7ubuntu0.10"],"available":[{"date":"2019-01-22","kind":"advisory","version":"4.0.3-7ubuntu0.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18557","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18557","date":"2026-11-02","epss":0.1496,"percentile":0.96711}],"risk":7.48,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18557"},"relatedVulnerabilities":[{"id":"CVE-2018-18557","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18557","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18557","date":"2026-11-02","epss":0.1496,"percentile":0.96711}],"urls":["https://access.redhat.com/errata/RHSA-2019:2053","https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-18557","https://gitlab.com/libtiff/libtiff/commit/681748ec2f5ce88da5f9fa6831e1653e46af8a66","https://gitlab.com/libtiff/libtiff/merge_requests/38","https://lists.debian.org/debian-lts-announce/2018/10/msg00019.html","https://security.gentoo.org/glsa/201904-15","https://usn.ubuntu.com/3864-1/","https://usn.ubuntu.com/3906-2/","https://www.debian.org/security/2018/dsa-4349","https://www.exploit-db.com/exploits/45694/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18557","description":"LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6110","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6110","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-11-02","epss":0.24901,"percentile":0.97911}],"risk":7.470300000000001,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6110"},"relatedVulnerabilities":[{"id":"CVE-2019-6110","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-11-02","epss":0.24901,"percentile":0.97911}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://www.exploit-db.com/exploits/46193/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-412672.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6110","description":"In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred."}]},{"artifact":{"id":"c0fc697d6f7b9986","cpes":["cpe:2.3:a:libtiff5:libtiff5:4.0.3-7ubuntu0.7:*:*:*:*:*:*:*"],"name":"libtiff5","purl":"pkg:deb/ubuntu/libtiff5@4.0.3-7ubuntu0.7?arch=amd64&distro=ubuntu-14.04&upstream=tiff","type":"deb","version":"4.0.3-7ubuntu0.7","language":"","licenses":["sha256:af0acd0969682339cb3d81dd24ec0b6c91d6d9c671619e390c6381cd6a3faa5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff5/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libtiff5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.3-7ubuntu0.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12900","versionConstraint":"< 4.0.3-7ubuntu0.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tiff","version":"4.0.3-7ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12900","fix":{"state":"fixed","versions":["4.0.3-7ubuntu0.11"],"available":[{"date":"2019-03-12","kind":"advisory","version":"4.0.3-7ubuntu0.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12900","date":"2026-11-02","epss":0.2483,"percentile":0.97905}],"risk":7.449,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12900"},"relatedVulnerabilities":[{"id":"CVE-2018-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12900","date":"2026-11-02","epss":0.2483,"percentile":0.97905}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2798","https://access.redhat.com/errata/RHSA-2019:2053","https://access.redhat.com/errata/RHSA-2019:3419","https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-12900","https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html","https://usn.ubuntu.com/3906-1/","https://usn.ubuntu.com/3906-2/","https://www.debian.org/security/2020/dsa-4670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12900","description":"Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-11-02","epss":0.14887,"percentile":0.96699}],"risk":7.4435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-11-02","epss":0.14887,"percentile":0.96699}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-11-02","epss":0.14887,"percentile":0.96699}],"risk":7.4435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-11-02","epss":0.14887,"percentile":0.96699}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"7a6e543b92a4ef77","cpes":["cpe:2.3:a:krb5-locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5-locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"krb5-locales","purl":"pkg:deb/ubuntu/krb5-locales@1.12%2Bdfsg-2ubuntu5.3?arch=all&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-locales/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/krb5-locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"822a09707628283f","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"09841dafbf852f74","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"4ce9194e589daeec","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"93d7ce3a1a88f7d6","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-11-02","epss":0.14859,"percentile":0.96696}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2799","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2799","date":"2026-11-02","epss":0.14771,"percentile":0.96681}],"risk":7.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2799"},"relatedVulnerabilities":[{"id":"CVE-2018-2799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2799","date":"2026-11-02","epss":0.14771,"percentile":0.96681}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103872","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E","https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3E","https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3E","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2799","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2799","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2799","date":"2026-11-02","epss":0.14771,"percentile":0.96681}],"risk":7.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2799"},"relatedVulnerabilities":[{"id":"CVE-2018-2799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2799","date":"2026-11-02","epss":0.14771,"percentile":0.96681}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103872","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E","https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3E","https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3E","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2799","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1305","versionConstraint":"< 7.0.52-1ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1305","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.14"],"available":[{"date":"2018-05-30","kind":"advisory","version":"7.0.52-1ubuntu0.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1305","date":"2026-11-02","epss":0.14472,"percentile":0.96631}],"risk":7.236,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1305"},"relatedVulnerabilities":[{"id":"CVE-2018-1305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1305","date":"2026-11-02","epss":0.14472,"percentile":0.96631}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103144","http://www.securitytracker.com/id/1040428","https://access.redhat.com/errata/RHSA-2018:0465","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://security.netapp.com/advisory/ntap-20180706-0001/","https://usn.ubuntu.com/3665-1/","https://www.debian.org/security/2018/dsa-4281","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1305","description":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-21733","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-21733","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-21733","cwe":"CWE-209","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-21733","date":"2026-11-02","epss":0.14286,"percentile":0.966}],"risk":7.142999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-21733"},"relatedVulnerabilities":[{"id":"CVE-2024-21733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21733","cwe":"CWE-209","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-21733","date":"2026-11-02","epss":0.14286,"percentile":0.966}],"urls":["https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz","http://packetstormsecurity.com/files/176951/Apache-Tomcat-8.5.63-9.0.43-HTTP-Response-Smuggling.html","http://www.openwall.com/lists/oss-security/2024/01/19/2","https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","https://security.netapp.com/advisory/ntap-20240216-0005/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21733","description":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue."}]},{"artifact":{"id":"4ced6a17da239544","cpes":["cpe:2.3:a:libnetty-java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty-java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*"],"name":"libnetty-java","purl":"pkg:deb/ubuntu/libnetty-java@1%3A3.2.6.Final-2?arch=all&distro=ubuntu-14.04&upstream=netty","type":"deb","version":"1:3.2.6.Final-2","language":"","licenses":["sha256:637e6b5538594243e93cd1a7c7516fa6c55bc4d6a304434915fa623e69d0156f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.list"}],"upstreams":[{"name":"netty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"netty","version":"1:3.2.6.Final-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20445","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20445","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20445","date":"2026-11-02","epss":0.13834,"percentile":0.96522}],"risk":6.917,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20445"},"relatedVulnerabilities":[{"id":"CVE-2019-20445","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20445","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20445","date":"2026-11-02","epss":0.13834,"percentile":0.96522}],"urls":["https://access.redhat.com/errata/RHSA-2020:0497","https://access.redhat.com/errata/RHSA-2020:0567","https://access.redhat.com/errata/RHSA-2020:0601","https://access.redhat.com/errata/RHSA-2020:0605","https://access.redhat.com/errata/RHSA-2020:0606","https://access.redhat.com/errata/RHSA-2020:0804","https://access.redhat.com/errata/RHSA-2020:0805","https://access.redhat.com/errata/RHSA-2020:0806","https://access.redhat.com/errata/RHSA-2020:0811","https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final","https://github.com/netty/netty/issues/9861","https://lists.apache.org/thread.html/r030beff88aeb6d7a2d6cd21342bd18686153ce6e26a4171d0e035663%40%3Cissues.flume.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d%40%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r46f93de62b1e199f3f9babb18128681677c53493546f532ed88c359d%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4ff40646e9ccce13560458419accdfc227b8b6ca4ead3a8a91decc74%40%3Cissues.flume.apache.org%3E","https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f8041e21598e8818fc2c45%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f%40%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb5c065e7bd701b0744f9f28ad769943f91745102716c1eb516325f11%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbdb59c683d666130906a9c05a1d2b034c4cc08cda7ed41322bd54fe2%40%3Cissues.flume.apache.org%3E","https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114%40%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html","https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/","https://usn.ubuntu.com/4532-1/","https://www.debian.org/security/2021/dsa-4885"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20445","description":"HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header."}]},{"artifact":{"id":"dba47ceadd4198eb","cpes":["cpe:2.3:a:libbatik-java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik-java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*"],"name":"libbatik-java","purl":"pkg:deb/ubuntu/libbatik-java@1.7.ubuntu-8ubuntu2.14.04.2?arch=all&distro=ubuntu-14.04&upstream=batik","type":"deb","version":"1.7.ubuntu-8ubuntu2.14.04.2","language":"","licenses":["sha256:5f184f3d7c36b1936ca4b863891979662da999f1d694d0ac22b078e77173af51"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbatik-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libbatik-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.list"}],"upstreams":[{"name":"batik"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"batik","version":"1.7.ubuntu-8ubuntu2.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-11987","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-11987","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-11987","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11987","date":"2026-11-02","epss":0.13635,"percentile":0.9648}],"risk":6.8175,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-11987"},"relatedVulnerabilities":[{"id":"CVE-2020-11987","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11987","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-11987","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11987","date":"2026-11-02","epss":0.13635,"percentile":0.9648}],"urls":["https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5/","https://security.gentoo.org/glsa/202401-11","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://xmlgraphics.apache.org/security.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11987","description":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1354","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1354","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-11-02","epss":0.22598,"percentile":0.97719}],"risk":6.779399999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1354"},"relatedVulnerabilities":[{"id":"CVE-2019-1354","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-11-02","epss":0.22598,"percentile":0.97719}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1354","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1354","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1354","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-11-02","epss":0.22598,"percentile":0.97719}],"risk":6.779399999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1354"},"relatedVulnerabilities":[{"id":"CVE-2019-1354","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1354","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1354","date":"2026-11-02","epss":0.22598,"percentile":0.97719}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1354","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.8.7"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2017-3738","versionConstraint":">= 4.2.0, < 4.8.7||>= 6.9.0, < 6.12.2||>= 8.9.0, < 8.9.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-3738","fix":{"state":"fixed","versions":["4.8.7","6.12.2","8.9.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.8.7"},{"date":"2025-09-04","kind":"first-observed","version":"6.12.2"},{"date":"2025-09-04","kind":"first-observed","version":"8.9.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3738","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3738","date":"2026-11-02","epss":0.13411,"percentile":0.96424}],"risk":6.7725550000000005,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/102118","http://www.securitytracker.com/id/1039978","https://access.redhat.com/errata/RHSA-2018:0998","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a","https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20171208-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us","https://www.debian.org/security/2017/dsa-4065","https://www.debian.org/security/2018/dsa-4157","https://www.openssl.org/news/secadv/20171207.txt","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-16","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3738","description":"There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository."},"relatedVulnerabilities":[]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-7810","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-7810","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2015-06-07","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-7810","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-7810","date":"2026-11-02","epss":0.13349,"percentile":0.96411}],"risk":6.6745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-7810"},"relatedVulnerabilities":[{"id":"CVE-2014-7810","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-7810","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-7810","date":"2026-11-02","epss":0.13349,"percentile":0.96411}],"urls":["http://marc.info/?l=bugtraq&m=145974991225029&w=2","http://rhn.redhat.com/errata/RHSA-2015-1621.html","http://rhn.redhat.com/errata/RHSA-2015-1622.html","http://rhn.redhat.com/errata/RHSA-2016-0492.html","http://rhn.redhat.com/errata/RHSA-2016-2046.html","http://svn.apache.org/viewvc?view=revision&revision=1644018","http://svn.apache.org/viewvc?view=revision&revision=1645642","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www.debian.org/security/2015/dsa-3428","http://www.debian.org/security/2016/dsa-3447","http://www.debian.org/security/2016/dsa-3530","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.securityfocus.com/bid/74665","http://www.securitytracker.com/id/1032330","http://www.ubuntu.com/usn/USN-2654-1","http://www.ubuntu.com/usn/USN-2655-1","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-7810","description":"The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.8.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-9841","versionConstraint":">= 4.0.0, < 4.8.2||>= 6.0.0, < 6.10.2||>= 7.0.0, < 7.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["4.8.2","6.10.2","7.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.8.2"},{"date":"2025-09-04","kind":"first-observed","version":"6.10.2"},{"date":"2025-09-04","kind":"first-observed","version":"7.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-11-02","epss":0.0755,"percentile":0.94516}],"risk":6.662875,"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."},"relatedVulnerabilities":[]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5648","versionConstraint":"< 7.0.52-1ubuntu0.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5648","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.13"],"available":[{"date":"2018-01-08","kind":"advisory","version":"7.0.52-1ubuntu0.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5648","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5648","date":"2026-11-02","epss":0.13225,"percentile":0.96377}],"risk":6.612500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5648"},"relatedVulnerabilities":[{"id":"CVE-2017-5648","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5648","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5648","date":"2026-11-02","epss":0.13225,"percentile":0.96377}],"urls":["http://www.debian.org/security/2017/dsa-3842","http://www.debian.org/security/2017/dsa-3843","http://www.openwall.com/lists/oss-security/2020/07/20/8","http://www.securityfocus.com/bid/97530","http://www.securitytracker.com/id/1038220","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:1809","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5648","description":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"risk":6.583,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"risk":6.583,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"risk":6.583,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"risk":6.583,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-11-02","epss":0.13166,"percentile":0.96365}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.7.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-7055","versionConstraint":">= 4.2.0, < 4.7.3||>= 6.9.0, < 6.9.5 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-7055","fix":{"state":"fixed","versions":["4.7.3","6.9.5"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.7.3"},{"date":"2025-09-04","kind":"first-observed","version":"6.9.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-7055","date":"2026-11-02","epss":0.14225,"percentile":0.96589}],"risk":6.579062499999999,"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94242","http://www.securitytracker.com/id/1037261","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03752en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03744en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://www.openssl.org/news/secadv/20161110.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7055","description":"There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behaviour. Even then only clients that chose the curve will be affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0714","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0714","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-02-24","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0714","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0714","date":"2026-11-02","epss":0.13075,"percentile":0.96351}],"risk":6.5375000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0714"},"relatedVulnerabilities":[{"id":"CVE-2016-0714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0714","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0714","date":"2026-11-02","epss":0.13075,"percentile":0.96351}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","http://marc.info/?l=bugtraq&m=145974991225029&w=2","http://rhn.redhat.com/errata/RHSA-2016-1089.html","http://rhn.redhat.com/errata/RHSA-2016-2045.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://seclists.org/bugtraq/2016/Feb/145","http://svn.apache.org/viewvc?view=revision&revision=1725263","http://svn.apache.org/viewvc?view=revision&revision=1725914","http://svn.apache.org/viewvc?view=revision&revision=1726196","http://svn.apache.org/viewvc?view=revision&revision=1726203","http://svn.apache.org/viewvc?view=revision&revision=1726923","http://svn.apache.org/viewvc?view=revision&revision=1727034","http://svn.apache.org/viewvc?view=revision&revision=1727166","http://svn.apache.org/viewvc?view=revision&revision=1727182","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.debian.org/security/2016/dsa-3609","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.securityfocus.com/bid/83327","http://www.securitytracker.com/id/1035069","http://www.securitytracker.com/id/1037640","http://www.ubuntu.com/usn/USN-3024-1","https://access.redhat.com/errata/RHSA-2016:1087","https://access.redhat.com/errata/RHSA-2016:1088","https://bto.bluecoat.com/security-advisory/sa118","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180531-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0714","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session."}]},{"artifact":{"id":"4b54bb58d74f5e0c","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A7.4.052-1ubuntu3.1?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3.1","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-common.preinst"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0714","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-11-02","epss":0.12712,"percentile":0.96266}],"risk":6.356000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0714"},"relatedVulnerabilities":[{"id":"CVE-2022-0714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-11-02","epss":0.12712,"percentile":0.96266}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa","https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3","https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/","https://security.gentoo.org/glsa/202208-32","https://support.apple.com/kb/HT213488"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0714","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436."}]},{"artifact":{"id":"a2ec081aadd3389e","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:7.4.052-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A7.4.052-1ubuntu3.1?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3.1","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0714","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-11-02","epss":0.12712,"percentile":0.96266}],"risk":6.356000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0714"},"relatedVulnerabilities":[{"id":"CVE-2022-0714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-11-02","epss":0.12712,"percentile":0.96266}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa","https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3","https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/","https://security.gentoo.org/glsa/202208-32","https://support.apple.com/kb/HT213488"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0714","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-8034","versionConstraint":"< 7.0.52-1ubuntu0.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-8034","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.15"],"available":[{"date":"2018-07-25","kind":"advisory","version":"7.0.52-1ubuntu0.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-8034","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-8034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-8034","date":"2026-11-02","epss":0.21048,"percentile":0.97576}],"risk":6.314399999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-8034"},"relatedVulnerabilities":[{"id":"CVE-2018-8034","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8034","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-8034","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-8034","date":"2026-11-02","epss":0.21048,"percentile":0.97576}],"urls":["http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104895","http://www.securitytracker.com/id/1041374","https://access.redhat.com/errata/RHSA-2019:0130","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0450","https://access.redhat.com/errata/RHSA-2019:0451","https://access.redhat.com/errata/RHSA-2019:1159","https://access.redhat.com/errata/RHSA-2019:1160","https://access.redhat.com/errata/RHSA-2019:1161","https://access.redhat.com/errata/RHSA-2019:1162","https://access.redhat.com/errata/RHSA-2019:1529","https://access.redhat.com/errata/RHSA-2019:2205","https://access.redhat.com/errata/RHSA-2019:3892","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html","https://security.netapp.com/advisory/ntap-20180817-0001/","https://usn.ubuntu.com/3723-1/","https://www.debian.org/security/2018/dsa-4281","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8034","description":"The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0227","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0227","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2015-02-15","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0227","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0227","date":"2026-11-02","epss":0.21045,"percentile":0.97576}],"risk":6.3134999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0227"},"relatedVulnerabilities":[{"id":"CVE-2014-0227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0227","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0227","date":"2026-11-02","epss":0.21045,"percentile":0.97576}],"urls":["http://advisories.mageia.org/MGASA-2015-0081.html","http://archives.neohapsis.com/archives/bugtraq/2015-02/0067.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html","http://marc.info/?l=bugtraq&m=143393515412274&w=2","http://marc.info/?l=bugtraq&m=143403519711434&w=2","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0983.html","http://rhn.redhat.com/errata/RHSA-2015-0991.html","http://svn.apache.org/viewvc?view=revision&revision=1600984","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www.debian.org/security/2016/dsa-3447","http://www.debian.org/security/2016/dsa-3530","http://www.mandriva.com/security/advisories?name=MDVSA-2015:052","http://www.mandriva.com/security/advisories?name=MDVSA-2015:053","http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.securityfocus.com/bid/72717","http://www.securitytracker.com/id/1032791","http://www.ubuntu.com/usn/USN-2654-1","http://www.ubuntu.com/usn/USN-2655-1","https://bugzilla.redhat.com/show_bug.cgi?id=1109196","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://source.jboss.org/changelog/JBossWeb?cs=2455"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0227","description":"java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.23"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1f-1ubuntu2.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.23"],"available":[{"date":"2017-11-06","kind":"advisory","version":"1.0.1f-1ubuntu2.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-11-02","epss":0.20968,"percentile":0.97563}],"risk":6.2904,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-11-02","epss":0.20968,"percentile":0.97563}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1f-1ubuntu2.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.23"],"available":[{"date":"2017-11-06","kind":"advisory","version":"1.0.1f-1ubuntu2.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-11-02","epss":0.20968,"percentile":0.97563}],"risk":6.2904,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-11-02","epss":0.20968,"percentile":0.97563}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-8014","versionConstraint":"< 7.0.52-1ubuntu0.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-8014","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.14"],"available":[{"date":"2018-05-30","kind":"advisory","version":"7.0.52-1ubuntu0.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-8014","cwe":"CWE-1188","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8014","date":"2026-11-02","epss":0.20942,"percentile":0.9756}],"risk":6.2825999999999995,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-8014"},"relatedVulnerabilities":[{"id":"CVE-2018-8014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8014","cwe":"CWE-1188","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8014","date":"2026-11-02","epss":0.20942,"percentile":0.9756}],"urls":["http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104203","http://www.securitytracker.com/id/1040998","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2018:2469","https://access.redhat.com/errata/RHSA-2018:2470","https://access.redhat.com/errata/RHSA-2018:3768","https://access.redhat.com/errata/RHSA-2019:0450","https://access.redhat.com/errata/RHSA-2019:0451","https://access.redhat.com/errata/RHSA-2019:1529","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://seclists.org/bugtraq/2019/Dec/43","https://security.netapp.com/advisory/ntap-20181018-0002/","https://usn.ubuntu.com/3665-1/","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8014","description":"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-11-02","epss":0.20743,"percentile":0.97536}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.21.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"],"vulnerabilityID":"CVE-2020-8174","versionConstraint":"< 10.21.0||>= 12.0.0, < 12.18.0||>= 14.0.0, < 14.4.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-8174","fix":{"state":"fixed","versions":["10.21.0","12.18.0","14.4.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"10.21.0"},{"date":"2025-09-04","kind":"first-observed","version":"12.18.0"},{"date":"2025-09-04","kind":"first-observed","version":"14.4.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8174","cwe":"CWE-119","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8174","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8174","date":"2026-11-02","epss":0.07646,"percentile":0.94574}],"risk":6.1932599999999995,"urls":["https://hackerone.com/reports/784186","https://security.gentoo.org/glsa/202101-07","https://security.netapp.com/advisory/ntap-20201023-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8174","description":"napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0."},"relatedVulnerabilities":[]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0230","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0230","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2015-06-07","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0230","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0230","date":"2026-11-02","epss":0.20183,"percentile":0.97461}],"risk":6.0549,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0230"},"relatedVulnerabilities":[{"id":"CVE-2014-0230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0230","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0230","date":"2026-11-02","epss":0.20183,"percentile":0.97461}],"urls":["http://mail-archives.apache.org/mod_mbox/tomcat-announce/201505.mbox/%3C554949D1.8030904%40apache.org%3E","http://marc.info/?l=bugtraq&m=144498216801440&w=2","http://marc.info/?l=bugtraq&m=145974991225029&w=2","http://openwall.com/lists/oss-security/2015/04/10/1","http://rhn.redhat.com/errata/RHSA-2015-1621.html","http://rhn.redhat.com/errata/RHSA-2015-1622.html","http://rhn.redhat.com/errata/RHSA-2015-2661.html","http://rhn.redhat.com/errata/RHSA-2016-0595.html","http://rhn.redhat.com/errata/RHSA-2016-0596.html","http://rhn.redhat.com/errata/RHSA-2016-0597.html","http://rhn.redhat.com/errata/RHSA-2016-0598.html","http://rhn.redhat.com/errata/RHSA-2016-0599.html","http://svn.apache.org/viewvc?view=revision&revision=1603770","http://svn.apache.org/viewvc?view=revision&revision=1603775","http://svn.apache.org/viewvc?view=revision&revision=1603779","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www.debian.org/security/2016/dsa-3447","http://www.debian.org/security/2016/dsa-3530","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.securityfocus.com/bid/74475","http://www.ubuntu.com/usn/USN-2654-1","http://www.ubuntu.com/usn/USN-2655-1","https://access.redhat.com/errata/RHSA-2015:2659","https://access.redhat.com/errata/RHSA-2015:2660","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","https://issues.jboss.org/browse/JWS-219","https://issues.jboss.org/browse/JWS-220","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0230","description":"Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts."}]},{"artifact":{"id":"15886aa5b24c9607","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.4:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.4?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.4","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-11-02","epss":0.12109,"percentile":0.96149}],"risk":6.0545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36230"},"relatedVulnerabilities":[{"id":"CVE-2020-36230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-11-02","epss":0.12109,"percentile":0.96149}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9423","https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2698","date":"2026-11-02","epss":0.12013,"percentile":0.96132}],"risk":6.0065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2698"},"relatedVulnerabilities":[{"id":"CVE-2019-2698","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2698","date":"2026-11-02","epss":0.12013,"percentile":0.96132}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2698","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2698","date":"2026-11-02","epss":0.12013,"percentile":0.96132}],"risk":6.0065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2698"},"relatedVulnerabilities":[{"id":"CVE-2019-2698","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2698","date":"2026-11-02","epss":0.12013,"percentile":0.96132}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2698","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5212eef948846ef8","cpes":["cpe:2.3:a:libvorbis0a:libvorbis0a:1.3.2-1.3ubuntu1:*:*:*:*:*:*:*"],"name":"libvorbis0a","purl":"pkg:deb/ubuntu/libvorbis0a@1.3.2-1.3ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=libvorbis","type":"deb","version":"1.3.2-1.3ubuntu1","language":"","licenses":["sha256:b409692e039c3f1cb597a309c583dbe6d3f97fc7993904e6a478ab15b196d625"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libvorbis0a/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libvorbis0a/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libvorbis0a:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libvorbis0a:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libvorbis"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-1.3ubuntu1.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5146","versionConstraint":"< 1.3.2-1.3ubuntu1.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libvorbis","version":"1.3.2-1.3ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5146","fix":{"state":"fixed","versions":["1.3.2-1.3ubuntu1.2"],"available":[{"date":"2018-03-22","kind":"advisory","version":"1.3.2-1.3ubuntu1.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-11-02","epss":0.11905,"percentile":0.96107}],"risk":5.952500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5146"},"relatedVulnerabilities":[{"id":"CVE-2018-5146","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-11-02","epss":0.11905,"percentile":0.96107}],"urls":["http://www.securityfocus.com/bid/103432","http://www.securitytracker.com/id/1040544","https://access.redhat.com/errata/RHSA-2018:0549","https://access.redhat.com/errata/RHSA-2018:0647","https://access.redhat.com/errata/RHSA-2018:0648","https://access.redhat.com/errata/RHSA-2018:0649","https://access.redhat.com/errata/RHSA-2018:1058","https://bugzilla.mozilla.org/show_bug.cgi?id=1446062","https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00029.html","https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html","https://security.gentoo.org/glsa/201811-13","https://usn.ubuntu.com/3545-1/","https://usn.ubuntu.com/3599-1/","https://usn.ubuntu.com/3604-1/","https://www.debian.org/security/2018/dsa-4140","https://www.debian.org/security/2018/dsa-4143","https://www.debian.org/security/2018/dsa-4155","https://www.mozilla.org/security/advisories/mfsa2018-08/","https://www.mozilla.org/security/advisories/mfsa2018-09/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5146","description":"An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7."}]},{"artifact":{"id":"dd6c8e0610f33678","cpes":["cpe:2.3:a:libvorbisenc2:libvorbisenc2:1.3.2-1.3ubuntu1:*:*:*:*:*:*:*"],"name":"libvorbisenc2","purl":"pkg:deb/ubuntu/libvorbisenc2@1.3.2-1.3ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=libvorbis","type":"deb","version":"1.3.2-1.3ubuntu1","language":"","licenses":["sha256:b409692e039c3f1cb597a309c583dbe6d3f97fc7993904e6a478ab15b196d625"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libvorbisenc2/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libvorbisenc2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libvorbisenc2:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libvorbisenc2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libvorbis"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-1.3ubuntu1.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5146","versionConstraint":"< 1.3.2-1.3ubuntu1.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libvorbis","version":"1.3.2-1.3ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5146","fix":{"state":"fixed","versions":["1.3.2-1.3ubuntu1.2"],"available":[{"date":"2018-03-22","kind":"advisory","version":"1.3.2-1.3ubuntu1.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-11-02","epss":0.11905,"percentile":0.96107}],"risk":5.952500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5146"},"relatedVulnerabilities":[{"id":"CVE-2018-5146","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-11-02","epss":0.11905,"percentile":0.96107}],"urls":["http://www.securityfocus.com/bid/103432","http://www.securitytracker.com/id/1040544","https://access.redhat.com/errata/RHSA-2018:0549","https://access.redhat.com/errata/RHSA-2018:0647","https://access.redhat.com/errata/RHSA-2018:0648","https://access.redhat.com/errata/RHSA-2018:0649","https://access.redhat.com/errata/RHSA-2018:1058","https://bugzilla.mozilla.org/show_bug.cgi?id=1446062","https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00029.html","https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html","https://security.gentoo.org/glsa/201811-13","https://usn.ubuntu.com/3545-1/","https://usn.ubuntu.com/3599-1/","https://usn.ubuntu.com/3604-1/","https://www.debian.org/security/2018/dsa-4140","https://www.debian.org/security/2018/dsa-4143","https://www.debian.org/security/2018/dsa-4155","https://www.mozilla.org/security/advisories/mfsa2018-08/","https://www.mozilla.org/security/advisories/mfsa2018-09/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5146","description":"An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-11-02","epss":0.11844,"percentile":0.96094}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"12.22.9"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"],"vulnerabilityID":"CVE-2021-44531","versionConstraint":"< 12.22.9||>= 14.0.0, < 14.18.3||>= 16.0.0, < 16.13.2||>= 17.0.0, < 17.3.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-44531","fix":{"state":"fixed","versions":["12.22.9","14.18.3","16.13.2","17.3.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"12.22.9"},{"date":"2025-09-04","kind":"first-observed","version":"14.18.3"},{"date":"2025-09-04","kind":"first-observed","version":"16.13.2"},{"date":"2025-09-04","kind":"first-observed","version":"17.3.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44531","cwe":"CWE-295","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-44531","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44531","date":"2026-11-02","epss":0.08373,"percentile":0.94969}],"risk":5.902965,"urls":["https://hackerone.com/reports/1429694","https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","https://security.netapp.com/advisory/ntap-20220325-0007/","https://www.debian.org/security/2022/dsa-5170","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","description":"Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option."},"relatedVulnerabilities":[]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-11-02","epss":0.11676,"percentile":0.96058}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"a6c1ac4081940936","cpes":["cpe:2.3:a:libjdom1-java:libjdom1-java:1.1.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libjdom1-java:libjdom1_java:1.1.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libjdom1_java:libjdom1-java:1.1.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libjdom1_java:libjdom1_java:1.1.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libjdom1:libjdom1-java:1.1.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libjdom1:libjdom1_java:1.1.3-1:*:*:*:*:*:*:*"],"name":"libjdom1-java","purl":"pkg:deb/ubuntu/libjdom1-java@1.1.3-1?arch=all&distro=ubuntu-14.04","type":"deb","version":"1.1.3-1","language":"","licenses":["BSD-4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjdom1-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libjdom1-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjdom1-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjdom1-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjdom1-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjdom1-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-33813","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libjdom1-java","version":"1.1.3-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-33813","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33813","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33813","date":"2026-11-02","epss":0.19442,"percentile":0.97367}],"risk":5.8326,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33813"},"relatedVulnerabilities":[{"id":"CVE-2021-33813","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33813","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33813","date":"2026-11-02","epss":0.19442,"percentile":0.97367}],"urls":["https://alephsecurity.com/vulns/aleph-2021003","https://github.com/hunterhacker/jdom/pull/188","https://github.com/hunterhacker/jdom/releases","https://lists.apache.org/thread.html/r21c406c7ed88fe340db7dbae75e58355159e6c324037c7d5547bf40b%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5674106135bb1a6ef57483f4c63a9c44bca85d0e2a8a05895a8f1d89%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6db397ae7281ead825338200d1f62d2827585a70797cc9ac0c4bd23f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r845e987b7cd8efe610284958e997b84583f5a98d3394adc09e3482fe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r89b3800cfabb1e773e49425e5d4239c28a659839a2eca6af3431482e%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfb7a93e40ebeb1e0068cde0bf3834dcab46bb1ef06d6424db48ed9fd%40%3Cdev.tika.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2021/07/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AH46QHE5GIMT6BL6C3GDTOYF27JYILXM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWFVYTHGILOQXUA7U3SPOERQXL7OPSZG/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33813","description":"An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request."}]},{"artifact":{"id":"317591c0ff4043db","cpes":["cpe:2.3:a:libxerces2-java:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2-java:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2_java:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2_java:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*"],"name":"libxerces2-java","purl":"pkg:deb/ubuntu/libxerces2-java@2.11.0-7?arch=all&distro=ubuntu-14.04","type":"deb","version":"2.11.0-7","language":"","licenses":["sha256:7373dc9d304a40dc1c1be196be9bf3a4f45ac097cfc48d6fae99d494517a2efa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxerces2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libxerces2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxerces2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxerces2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxerces2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxerces2-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-23437","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxerces2-java","version":"2.11.0-7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-23437","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-23437","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23437","date":"2026-11-02","epss":0.11615,"percentile":0.96045}],"risk":5.8075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-23437"},"relatedVulnerabilities":[{"id":"CVE-2022-23437","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23437","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23437","date":"2026-11-02","epss":0.11615,"percentile":0.96045}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/24/3","https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl","https://security.netapp.com/advisory/ntap-20221028-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23437","description":"There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-11-02","epss":0.11608,"percentile":0.96043}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"80078cd148432765","cpes":["cpe:2.3:a:libplexus-archiver-java:libplexus-archiver-java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus-archiver-java:libplexus_archiver_java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus_archiver_java:libplexus-archiver-java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus_archiver_java:libplexus_archiver_java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus-archiver:libplexus-archiver-java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus-archiver:libplexus_archiver_java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus_archiver:libplexus-archiver-java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus_archiver:libplexus_archiver_java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus:libplexus-archiver-java:1.2-1:*:*:*:*:*:*:*","cpe:2.3:a:libplexus:libplexus_archiver_java:1.2-1:*:*:*:*:*:*:*"],"name":"libplexus-archiver-java","purl":"pkg:deb/ubuntu/libplexus-archiver-java@1.2-1?arch=all&distro=ubuntu-14.04&upstream=plexus-archiver","type":"deb","version":"1.2-1","language":"","licenses":["sha256:71a1b8b39ed05ffba750fd8dfce4fe45368f0a7797060f0167035929ed6ef5d9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libplexus-archiver-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libplexus-archiver-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libplexus-archiver-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libplexus-archiver-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libplexus-archiver-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libplexus-archiver-java.list"}],"upstreams":[{"name":"plexus-archiver"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.2-1+deb8u1build14.04.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1002200","versionConstraint":"< 1.2-1+deb8u1build14.04.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"plexus-archiver","version":"1.2-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1002200","fix":{"state":"fixed","versions":["1.2-1+deb8u1build14.04.1"],"available":[{"date":"2026-09-25","kind":"first-observed","version":"1.2-1+deb8u1build14.04.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1002200","cwe":"CWE-22","type":"Secondary","source":"report@snyk.io"},{"cve":"CVE-2018-1002200","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1002200","date":"2026-11-02","epss":0.11579,"percentile":0.96037}],"risk":5.7895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1002200"},"relatedVulnerabilities":[{"id":"CVE-2018-1002200","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1002200","cwe":"CWE-22","type":"Secondary","source":"report@snyk.io"},{"cve":"CVE-2018-1002200","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1002200","date":"2026-11-02","epss":0.11579,"percentile":0.96037}],"urls":["https://access.redhat.com/errata/RHSA-2018:1836","https://access.redhat.com/errata/RHSA-2018:1837","https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8","https://github.com/codehaus-plexus/plexus-archiver/pull/87","https://github.com/snyk/zip-slip-vulnerability","https://snyk.io/research/zip-slip-vulnerability","https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680","https://www.debian.org/security/2018/dsa-4227"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1002200","description":"plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'."}]},{"artifact":{"id":"2d3cdd73855dd6e7","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.4:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.4","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-18634","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-18634","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-18634","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18634","date":"2026-11-02","epss":0.19276,"percentile":0.9734}],"risk":5.782799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-18634"},"relatedVulnerabilities":[{"id":"CVE-2019-18634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18634","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18634","date":"2026-11-02","epss":0.19276,"percentile":0.9734}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html","http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html","http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html","http://seclists.org/fulldisclosure/2020/Jan/40","http://www.openwall.com/lists/oss-security/2020/01/30/6","http://www.openwall.com/lists/oss-security/2020/01/31/1","http://www.openwall.com/lists/oss-security/2020/02/05/2","http://www.openwall.com/lists/oss-security/2020/02/05/5","https://access.redhat.com/errata/RHSA-2020:0487","https://access.redhat.com/errata/RHSA-2020:0509","https://access.redhat.com/errata/RHSA-2020:0540","https://access.redhat.com/errata/RHSA-2020:0726","https://lists.debian.org/debian-lts-announce/2020/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/","https://seclists.org/bugtraq/2020/Feb/2","https://seclists.org/bugtraq/2020/Feb/3","https://seclists.org/bugtraq/2020/Jan/44","https://security.gentoo.org/glsa/202003-12","https://security.netapp.com/advisory/ntap-20200210-0001/","https://support.apple.com/kb/HT210919","https://usn.ubuntu.com/4263-1/","https://usn.ubuntu.com/4263-2/","https://www.debian.org/security/2020/dsa-4614","https://www.sudo.ws/alerts/pwfeedback.html","https://www.sudo.ws/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18634","description":"In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2697","date":"2026-11-02","epss":0.11466,"percentile":0.96013}],"risk":5.733,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2697"},"relatedVulnerabilities":[{"id":"CVE-2019-2697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2697","date":"2026-11-02","epss":0.11466,"percentile":0.96013}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-2697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-2697","date":"2026-11-02","epss":0.11466,"percentile":0.96013}],"risk":5.733,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-2697"},"relatedVulnerabilities":[{"id":"CVE-2019-2697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2697","date":"2026-11-02","epss":0.11466,"percentile":0.96013}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0763","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0763","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-02-24","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0763","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0763","date":"2026-11-02","epss":0.11297,"percentile":0.95976}],"risk":5.6485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0763"},"relatedVulnerabilities":[{"id":"CVE-2016-0763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0763","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0763","date":"2026-11-02","epss":0.11297,"percentile":0.95976}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","http://rhn.redhat.com/errata/RHSA-2016-1089.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://seclists.org/bugtraq/2016/Feb/147","http://svn.apache.org/viewvc?view=revision&revision=1725926","http://svn.apache.org/viewvc?view=revision&revision=1725929","http://svn.apache.org/viewvc?view=revision&revision=1725931","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.debian.org/security/2016/dsa-3609","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/83326","http://www.securitytracker.com/id/1035069","http://www.ubuntu.com/usn/USN-3024-1","https://access.redhat.com/errata/RHSA-2016:1087","https://access.redhat.com/errata/RHSA-2016:1088","https://bto.bluecoat.com/security-advisory/sa118","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180531-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0763","description":"The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-11-02","epss":0.11175,"percentile":0.95951}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-11-02","epss":0.11115,"percentile":0.95936}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5345","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5345","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-02-24","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5345","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-5345","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-5345","date":"2026-11-02","epss":0.1838,"percentile":0.97229}],"risk":5.513999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5345"},"relatedVulnerabilities":[{"id":"CVE-2015-5345","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5345","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-5345","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-5345","date":"2026-11-02","epss":0.1838,"percentile":0.97229}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","http://marc.info/?l=bugtraq&m=145974991225029&w=2","http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html","http://rhn.redhat.com/errata/RHSA-2016-1089.html","http://rhn.redhat.com/errata/RHSA-2016-2045.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://seclists.org/bugtraq/2016/Feb/146","http://seclists.org/fulldisclosure/2016/Feb/122","http://svn.apache.org/viewvc?view=revision&revision=1715206","http://svn.apache.org/viewvc?view=revision&revision=1715207","http://svn.apache.org/viewvc?view=revision&revision=1715213","http://svn.apache.org/viewvc?view=revision&revision=1715216","http://svn.apache.org/viewvc?view=revision&revision=1716882","http://svn.apache.org/viewvc?view=revision&revision=1716894","http://svn.apache.org/viewvc?view=revision&revision=1717209","http://svn.apache.org/viewvc?view=revision&revision=1717212","http://svn.apache.org/viewvc?view=revision&revision=1717216","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.debian.org/security/2016/dsa-3609","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html","http://www.securityfocus.com/bid/83328","http://www.securitytracker.com/id/1035071","http://www.ubuntu.com/usn/USN-3024-1","https://access.redhat.com/errata/RHSA-2016:1087","https://access.redhat.com/errata/RHSA-2016:1088","https://bto.bluecoat.com/security-advisory/sa118","https://bz.apache.org/bugzilla/show_bug.cgi?id=58765","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","https://kc.mcafee.com/corporate/index?page=content&id=SB10156","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180531-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5345","description":"The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 2.7.6-8ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.5"],"available":[{"date":"2018-11-13","kind":"advisory","version":"2.7.6-8ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-11-02","epss":0.10911,"percentile":0.95877}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"dba47ceadd4198eb","cpes":["cpe:2.3:a:libbatik-java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik-java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*"],"name":"libbatik-java","purl":"pkg:deb/ubuntu/libbatik-java@1.7.ubuntu-8ubuntu2.14.04.2?arch=all&distro=ubuntu-14.04&upstream=batik","type":"deb","version":"1.7.ubuntu-8ubuntu2.14.04.2","language":"","licenses":["sha256:5f184f3d7c36b1936ca4b863891979662da999f1d694d0ac22b078e77173af51"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbatik-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libbatik-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.list"}],"upstreams":[{"name":"batik"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"batik","version":"1.7.ubuntu-8ubuntu2.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-17566","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17566","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17566","date":"2026-11-02","epss":0.10867,"percentile":0.95862}],"risk":5.4335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-17566"},"relatedVulnerabilities":[{"id":"CVE-2019-17566","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17566","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17566","date":"2026-11-02","epss":0.10867,"percentile":0.95862}],"urls":["https://lists.apache.org/thread.html/rab94fe68b180d2e2fba97abf6fe1ec83cff826be25f86cd90f047171%40%3Ccommits.myfaces.apache.org%3E","https://lists.apache.org/thread.html/rcab14a9ec91aa4c151e0729966282920423eff50a22759fd21db6509%40%3Ccommits.myfaces.apache.org%3E","https://security.gentoo.org/glsa/202401-11","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://xmlgraphics.apache.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17566","description":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.14.4"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-12115","versionConstraint":"< 6.14.4||>= 10.0.0, < 10.9.0||>= 8.0.0, < 8.11.4 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-12115","fix":{"state":"fixed","versions":["6.14.4","8.11.4","10.9.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"6.14.4"},{"date":"2025-09-04","kind":"first-observed","version":"10.9.0"},{"date":"2025-09-04","kind":"first-observed","version":"8.11.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12115","cwe":"CWE-787","type":"Secondary","source":"cve-request@iojs.org"},{"cve":"CVE-2018-12115","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12115","date":"2026-11-02","epss":0.07779,"percentile":0.94649}],"risk":5.348062499999999,"urls":["http://www.securityfocus.com/bid/105127","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:2944","https://access.redhat.com/errata/RHSA-2018:2949","https://access.redhat.com/errata/RHSA-2018:3537","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/202003-48"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12115","description":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written."},"relatedVulnerabilities":[]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-11-02","epss":0.10668,"percentile":0.95805}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"ec96598ee4148655","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.6.2-1ubuntu2?arch=amd64&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-31535","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-31535","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"risk":5.317,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31535"},"relatedVulnerabilities":[{"id":"CVE-2021-31535","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"urls":["http://packetstormsecurity.com/files/162737/libX11-Insufficient-Length-Check-Injection.html","http://seclists.org/fulldisclosure/2021/May/52","http://www.openwall.com/lists/oss-security/2021/05/18/2","https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEOT4RLB76RVPJQKGGTIKTBIOLHX2NR6/","https://lists.freedesktop.org/archives/xorg/","https://lists.x.org/archives/xorg-announce/2021-May/003088.html","https://security.gentoo.org/glsa/202105-16","https://security.netapp.com/advisory/ntap-20210813-0001/","https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/","https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt","https://www.debian.org/security/2021/dsa-4920","https://www.openwall.com/lists/oss-security/2021/05/18/2","https://www.openwall.com/lists/oss-security/2021/05/18/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31535","description":"LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session."}]},{"artifact":{"id":"f413e30fd70e6608","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.6.2-1ubuntu2?arch=all&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-31535","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-31535","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"risk":5.317,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31535"},"relatedVulnerabilities":[{"id":"CVE-2021-31535","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"urls":["http://packetstormsecurity.com/files/162737/libX11-Insufficient-Length-Check-Injection.html","http://seclists.org/fulldisclosure/2021/May/52","http://www.openwall.com/lists/oss-security/2021/05/18/2","https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEOT4RLB76RVPJQKGGTIKTBIOLHX2NR6/","https://lists.freedesktop.org/archives/xorg/","https://lists.x.org/archives/xorg-announce/2021-May/003088.html","https://security.gentoo.org/glsa/202105-16","https://security.netapp.com/advisory/ntap-20210813-0001/","https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/","https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt","https://www.debian.org/security/2021/dsa-4920","https://www.openwall.com/lists/oss-security/2021/05/18/2","https://www.openwall.com/lists/oss-security/2021/05/18/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31535","description":"LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session."}]},{"artifact":{"id":"01d71893e1755ff6","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/ubuntu/libx11-xcb1@2%3A1.6.2-1ubuntu2?arch=amd64&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-31535","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-31535","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"risk":5.317,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31535"},"relatedVulnerabilities":[{"id":"CVE-2021-31535","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31535","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31535","date":"2026-11-02","epss":0.10634,"percentile":0.95796}],"urls":["http://packetstormsecurity.com/files/162737/libX11-Insufficient-Length-Check-Injection.html","http://seclists.org/fulldisclosure/2021/May/52","http://www.openwall.com/lists/oss-security/2021/05/18/2","https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEOT4RLB76RVPJQKGGTIKTBIOLHX2NR6/","https://lists.freedesktop.org/archives/xorg/","https://lists.x.org/archives/xorg-announce/2021-May/003088.html","https://security.gentoo.org/glsa/202105-16","https://security.netapp.com/advisory/ntap-20210813-0001/","https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/","https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt","https://www.debian.org/security/2021/dsa-4920","https://www.openwall.com/lists/oss-security/2021/05/18/2","https://www.openwall.com/lists/oss-security/2021/05/18/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31535","description":"LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session."}]},{"artifact":{"id":"2881b861437a9e40","cpes":["cpe:2.3:a:libcommons-io-java:libcommons-io-java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-io-java:libcommons_io_java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_io_java:libcommons-io-java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_io_java:libcommons_io_java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-io:libcommons-io-java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons-io:libcommons_io_java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_io:libcommons-io-java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons_io:libcommons_io_java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons-io-java:2.4-2:*:*:*:*:*:*:*","cpe:2.3:a:libcommons:libcommons_io_java:2.4-2:*:*:*:*:*:*:*"],"name":"libcommons-io-java","purl":"pkg:deb/ubuntu/libcommons-io-java@2.4-2?arch=all&distro=ubuntu-14.04&upstream=commons-io","type":"deb","version":"2.4-2","language":"","licenses":["sha256:61f164f2951dc263f016d1f4be65584677461805b03643f46c82c13d431aa1d2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcommons-io-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libcommons-io-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-io-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-io-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcommons-io-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libcommons-io-java.list"}],"upstreams":[{"name":"commons-io"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-29425","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"commons-io","version":"2.4-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-29425","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-11-02","epss":0.10549,"percentile":0.95773}],"risk":5.2745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-29425"},"relatedVulnerabilities":[{"id":"CVE-2021-29425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-11-02","epss":0.10549,"percentile":0.95773}],"urls":["https://issues.apache.org/jira/browse/IO-556","https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3E","https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html","https://security.netapp.com/advisory/ntap-20220210-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-29425","description":"In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"12.22.9"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"],"vulnerabilityID":"CVE-2021-44532","versionConstraint":"< 12.22.9||>= 14.0.0, < 14.18.3||>= 16.0.0, < 16.13.2||>= 17.0.0, < 17.3.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-44532","fix":{"state":"fixed","versions":["12.22.9","14.18.3","16.13.2","17.3.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"12.22.9"},{"date":"2025-09-04","kind":"first-observed","version":"14.18.3"},{"date":"2025-09-04","kind":"first-observed","version":"16.13.2"},{"date":"2025-09-04","kind":"first-observed","version":"17.3.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44532","cwe":"CWE-296","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-44532","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44532","date":"2026-11-02","epss":0.10364,"percentile":0.95721}],"risk":5.25973,"urls":["https://hackerone.com/reports/1429694","https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","https://security.netapp.com/advisory/ntap-20220325-0007/","https://www.debian.org/security/2022/dsa-5170","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","description":"Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option."},"relatedVulnerabilities":[]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-11-02","epss":0.06994,"percentile":0.94159}],"risk":5.2455,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-1971"},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-11-02","epss":0.06994,"percentile":0.94159}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-11-02","epss":0.06994,"percentile":0.94159}],"risk":5.2455,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-1971"},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-11-02","epss":0.06994,"percentile":0.94159}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"317591c0ff4043db","cpes":["cpe:2.3:a:libxerces2-java:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2-java:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2_java:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2_java:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2:libxerces2-java:2.11.0-7:*:*:*:*:*:*:*","cpe:2.3:a:libxerces2:libxerces2_java:2.11.0-7:*:*:*:*:*:*:*"],"name":"libxerces2-java","purl":"pkg:deb/ubuntu/libxerces2-java@2.11.0-7?arch=all&distro=ubuntu-14.04","type":"deb","version":"2.11.0-7","language":"","licenses":["sha256:7373dc9d304a40dc1c1be196be9bf3a4f45ac097cfc48d6fae99d494517a2efa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxerces2-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libxerces2-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxerces2-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxerces2-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxerces2-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libxerces2-java.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2012-0881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxerces2-java","version":"2.11.0-7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-0881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-0881","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-0881","date":"2026-11-02","epss":0.17461,"percentile":0.9713}],"risk":5.238299999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-0881"},"relatedVulnerabilities":[{"id":"CVE-2012-0881","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-0881","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-0881","date":"2026-11-02","epss":0.17461,"percentile":0.9713}],"urls":["http://www.openwall.com/lists/oss-security/2014/07/08/11","https://bugzilla.redhat.com/show_bug.cgi?id=787104","https://issues.apache.org/jira/browse/XERCESJ-1685","https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56%40%3Ccommon-issues.hadoop.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-0881","description":"Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2015-8855","versionConstraint":"<= 4.3.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2015-8855","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8855","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8855","date":"2026-11-02","epss":0.06887,"percentile":0.94073}],"risk":5.216902500000001,"urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/86957","https://nodesecurity.io/advisories/31"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8855","description":"The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a \"regular expression denial of service (ReDoS).\""},"relatedVulnerabilities":[]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.27.v20190403"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7vx9-xjhr-rw6h","versionConstraint":"<=9.2.26.v20180806 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7vx9-xjhr-rw6h","fix":{"state":"fixed","versions":["9.2.27.v20190403"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.2.27.v20190403"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10241","cwe":"CWE-79","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2019-10241","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10241","date":"2026-11-02","epss":0.09365,"percentile":0.95397}],"risk":5.197575,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10241","https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121","https://lists.apache.org/thread.html/01e004c3f7c7365863a27e7038b7f32dae56ccf3a496b277c9b7f7b6@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/464892b514c029dfc0c8656a93e1c0de983c473df70fdadbd224e09f@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/8bff534863c7aaf09bb17c3d0532777258dd3a5c7ddda34198cc2742@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/bcfb37bfba7b3d7e9c7808b5e5a38a98d6bb714d52cf5162bdd48e32@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/d7c4a664a34853f57c2163ab562f39802df5cf809523ea40c97289c1@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://security.netapp.com/advisory/ntap-20190509-0003/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html","https://www.debian.org/security/2021/dsa-4949"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7vx9-xjhr-rw6h","description":"Cross-site Scripting in Eclipse Jetty"},"relatedVulnerabilities":[{"id":"CVE-2019-10241","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10241","cwe":"CWE-79","type":"Secondary","source":"emo@eclipse.org"},{"cve":"CVE-2019-10241","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10241","date":"2026-11-02","epss":0.09365,"percentile":0.95397}],"urls":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121","https://lists.apache.org/thread.html/01e004c3f7c7365863a27e7038b7f32dae56ccf3a496b277c9b7f7b6%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/464892b514c029dfc0c8656a93e1c0de983c473df70fdadbd224e09f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/8bff534863c7aaf09bb17c3d0532777258dd3a5c7ddda34198cc2742%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/bcfb37bfba7b3d7e9c7808b5e5a38a98d6bb714d52cf5162bdd48e32%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/d7c4a664a34853f57c2163ab562f39802df5cf809523ea40c97289c1%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html","https://security.netapp.com/advisory/ntap-20190509-0003/","https://www.debian.org/security/2021/dsa-4949","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10241","description":"In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5018","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5018","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2016-5018","date":"2026-11-02","epss":0.10303,"percentile":0.95703}],"risk":5.1514999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5018"},"relatedVulnerabilities":[{"id":"CVE-2016-5018","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-5018","date":"2026-11-02","epss":0.10303,"percentile":0.95703}],"urls":["http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-1551.html","http://www.debian.org/security/2016/dsa-3720","http://www.securityfocus.com/bid/93942","http://www.securitytracker.com/id/1037142","http://www.securitytracker.com/id/1038757","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:1548","https://access.redhat.com/errata/RHSA-2017:1549","https://access.redhat.com/errata/RHSA-2017:1550","https://access.redhat.com/errata/RHSA-2017:1552","https://access.redhat.com/errata/RHSA-2017:2247","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180605-0001/","https://usn.ubuntu.com/4557-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5018","description":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-20346","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-11-02","epss":0.10229,"percentile":0.95678}],"risk":5.1145000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20346"},"relatedVulnerabilities":[{"id":"CVE-2018-20346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-11-02","epss":0.10229,"percentile":0.95678}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://www.securityfocus.com/bid/106323","https://access.redhat.com/articles/3758321","https://blade.tencent.com/magellan/index_en.html","https://bugzilla.redhat.com/show_bug.cgi?id=1659379","https://bugzilla.redhat.com/show_bug.cgi?id=1659677","https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html","https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e","https://crbug.com/900910","https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://news.ycombinator.com/item?id=18685296","https://security.gentoo.org/glsa/201904-21","https://sqlite.org/src/info/940f2adc8541a838","https://sqlite.org/src/info/d44318f59044162e","https://support.apple.com/HT209443","https://support.apple.com/HT209446","https://support.apple.com/HT209447","https://support.apple.com/HT209448","https://support.apple.com/HT209450","https://support.apple.com/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://worthdoingbadly.com/sqlitebug/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/releaselog/3_25_3.html","https://www.synology.com/security/advisory/Synology_SA_18_61"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20346","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan."}]},{"artifact":{"id":"2e742213a192b3e3","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.10:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.10?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-7183","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-7183","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"],"available":[{"date":"2018-07-09","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-7183","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7183","date":"2026-11-02","epss":0.10213,"percentile":0.95673}],"risk":5.1065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-7183"},"relatedVulnerabilities":[{"id":"CVE-2018-7183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7183","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7183","date":"2026-11-02","epss":0.10213,"percentile":0.95673}],"urls":["http://support.ntp.org/bin/view/Main/NtpBug3414","http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S","http://www.securityfocus.com/bid/103351","https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc","https://security.gentoo.org/glsa/201805-12","https://security.netapp.com/advisory/ntap-20180626-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us","https://usn.ubuntu.com/3707-1/","https://usn.ubuntu.com/3707-2/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.synology.com/support/security/Synology_SA_18_13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7183","description":"Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35550","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35550","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35550","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35550","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35550","date":"2026-11-02","epss":0.07376,"percentile":0.94418}],"risk":5.08944,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-5000","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35550","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.8.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-9843","versionConstraint":">= 4.0.0, < 4.8.2||>= 6.0.0, < 6.10.2||>= 7.0.0, < 7.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["4.8.2","6.10.2","7.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.8.2"},{"date":"2025-09-04","kind":"first-observed","version":"6.10.2"},{"date":"2025-09-04","kind":"first-observed","version":"7.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-11-02","epss":0.05766,"percentile":0.93085}],"risk":5.088495000000001,"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191||>= 9, < 11.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191||>= 9, < 11.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191||>= 9, < 11.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-3149","fix":{"state":"fixed","versions":["1.6.0_211","6.0.211","1.7.0_201","7.0.201","1.8.0_191","8.0.191","11.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_211"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_201"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_191"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.211"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.201"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.191"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3149","date":"2026-11-02","epss":0.07156,"percentile":0.94281}],"risk":5.08076,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105608","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3521","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://usn.ubuntu.com/3824-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3149","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2015-6764","versionConstraint":">= 4.2.0, < 4.2.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2015-6764","fix":{"state":"fixed","versions":["4.2.3"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.2.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-6764","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-6764","date":"2026-11-02","epss":0.05726,"percentile":0.93044}],"risk":5.053195,"urls":["http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html","http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html","http://www.debian.org/security/2015/dsa-3415","http://www.securityfocus.com/bid/78209","http://www.securitytracker.com/id/1034298","https://chromium.googlesource.com/v8/v8/+/6df9a1db8c85ab63dee63879456b6027df53fabc","https://code.google.com/p/chromium/issues/detail?id=554946","https://codereview.chromium.org/1440223002","https://security.gentoo.org/glsa/201603-09"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-6764","description":"The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code."},"relatedVulnerabilities":[]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"risk":4.952999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"risk":4.952999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"risk":4.952999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-11-02","epss":0.09906,"percentile":0.95582}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-30640","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-30640","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-30640","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-30640","date":"2026-11-02","epss":0.09886,"percentile":0.95573}],"risk":4.9430000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-30640"},"relatedVulnerabilities":[{"id":"CVE-2021-30640","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-30640","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-30640","date":"2026-11-02","epss":0.09886,"percentile":0.95573}],"urls":["https://lists.apache.org/thread.html/r59f9ef03929d32120f91f4ea7e6e79edd5688d75d0a9b65fd26d1fe8%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://security.gentoo.org/glsa/202208-34","https://security.netapp.com/advisory/ntap-20210827-0007/","https://www.debian.org/security/2021/dsa-4952","https://www.debian.org/security/2021/dsa-4986","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-30640","description":"A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-30640","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-30640","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-30640","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-30640","date":"2026-11-02","epss":0.09886,"percentile":0.95573}],"risk":4.9430000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-30640"},"relatedVulnerabilities":[{"id":"CVE-2021-30640","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-30640","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-30640","date":"2026-11-02","epss":0.09886,"percentile":0.95573}],"urls":["https://lists.apache.org/thread.html/r59f9ef03929d32120f91f4ea7e6e79edd5688d75d0a9b65fd26d1fe8%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://security.gentoo.org/glsa/202208-34","https://security.netapp.com/advisory/ntap-20210827-0007/","https://www.debian.org/security/2021/dsa-4952","https://www.debian.org/security/2021/dsa-4986","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-30640","description":"A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1240","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1240","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-09-16","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1240","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1240","date":"2026-11-02","epss":0.09783,"percentile":0.95541}],"risk":4.8915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1240"},"relatedVulnerabilities":[{"id":"CVE-2016-1240","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1240","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1240","date":"2026-11-02","epss":0.09783,"percentile":0.95541}],"urls":["http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html","http://packetstormsecurity.com/files/170857/Apache-Tomcat-On-Ubuntu-Log-Init-Privilege-Escalation.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://www.debian.org/security/2016/dsa-3669","http://www.debian.org/security/2016/dsa-3670","http://www.securityfocus.com/archive/1/539519/100/0/threaded","http://www.securityfocus.com/bid/93263","http://www.securitytracker.com/id/1036845","http://www.ubuntu.com/usn/USN-3081-1","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180731-0002/","https://www.exploit-db.com/exploits/40450/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1240","description":"The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-11-02","epss":0.0977,"percentile":0.95536}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2216","versionConstraint":"= 0.10.0||= 0.10.1||= 0.10.10||= 0.10.11||= 0.10.12||= 0.10.13||= 0.10.14||= 0.10.15||= 0.10.16||= 0.10.16-isaacs-manual||= 0.10.17||= 0.10.18||= 0.10.19||= 0.10.2||= 0.10.20||= 0.10.21||= 0.10.22||= 0.10.23||= 0.10.24||= 0.10.25||= 0.10.26||= 0.10.27||= 0.10.28||= 0.10.29||= 0.10.3||= 0.10.30||= 0.10.31||= 0.10.32||= 0.10.33||= 0.10.34||= 0.10.35||= 0.10.36||= 0.10.37||= 0.10.38||= 0.10.39||= 0.10.4||= 0.10.40||= 0.10.41||= 0.10.5||= 0.10.6||= 0.10.7||= 0.10.8||= 0.10.9||= 0.11.10||= 0.11.11||= 0.11.12||= 0.11.13||= 0.11.14||= 0.11.15||= 0.11.16||= 0.11.6||= 0.11.7||= 0.11.8||= 0.11.9||= 0.12.0||= 0.12.1||= 0.12.2||= 0.12.3||= 0.12.4||= 0.12.5||= 0.12.6||= 0.12.7||= 0.12.8||= 0.12.9||= 4.0.0||= 4.1.0||= 4.1.1||= 4.1.2||= 4.2.0||= 4.2.1||= 4.2.2||= 4.2.3||= 4.2.4||= 4.2.5||= 4.2.6||= 5.0.0||= 5.1.0||= 5.1.1||= 5.2.0||= 5.3.0||= 5.4.0||= 5.4.1||= 5.5.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2216","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2216","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2216","date":"2026-11-02","epss":0.07262,"percentile":0.94349}],"risk":4.865540000000001,"urls":["http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/","http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf","http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html","http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html","http://www.securityfocus.com/bid/83141","https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/","https://security.gentoo.org/glsa/201612-43"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2216","description":"The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a."},"relatedVulnerabilities":[]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2013-6629","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2013-6629","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2013-6629","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-6629","date":"2026-11-02","epss":0.0973,"percentile":0.95519}],"risk":4.865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2013-6629"},"relatedVulnerabilities":[{"id":"CVE-2013-6629","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2013-6629","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-6629","date":"2026-11-02","epss":0.0973,"percentile":0.95519}],"urls":["http://advisories.mageia.org/MGASA-2013-0333.html","http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html","http://bugs.ghostscript.com/show_bug.cgi?id=686980","http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html","http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html","http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html","http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html","http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html","http://marc.info/?l=bugtraq&m=140852886808946&w=2","http://marc.info/?l=bugtraq&m=140852974709252&w=2","http://rhn.redhat.com/errata/RHSA-2013-1803.html","http://rhn.redhat.com/errata/RHSA-2013-1804.html","http://secunia.com/advisories/56175","http://secunia.com/advisories/58974","http://secunia.com/advisories/59058","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT6150","http://support.apple.com/kb/HT6162","http://support.apple.com/kb/HT6163","http://www-01.ibm.com/support/docview.wss?uid=swg21672080","http://www-01.ibm.com/support/docview.wss?uid=swg21676746","http://www.debian.org/security/2013/dsa-2799","http://www.mandriva.com/security/advisories?name=MDVSA-2013:273","http://www.mozilla.org/security/announce/2013/mfsa2013-116.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html","http://www.securityfocus.com/bid/63676","http://www.securitytracker.com/id/1029470","http://www.securitytracker.com/id/1029476","http://www.ubuntu.com/usn/USN-2052-1","http://www.ubuntu.com/usn/USN-2053-1","http://www.ubuntu.com/usn/USN-2060-1","https://access.redhat.com/errata/RHSA-2014:0413","https://access.redhat.com/errata/RHSA-2014:0414","https://bugzilla.mozilla.org/show_bug.cgi?id=891693","https://code.google.com/p/chromium/issues/detail?id=258723","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629","https://security.gentoo.org/glsa/201606-03","https://src.chromium.org/viewvc/chrome?revision=229729&view=revision","https://www.ibm.com/support/docview.wss?uid=swg21675973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2013-6629","description":"The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2013-6629","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2013-6629","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2013-6629","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-6629","date":"2026-11-02","epss":0.0973,"percentile":0.95519}],"risk":4.865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2013-6629"},"relatedVulnerabilities":[{"id":"CVE-2013-6629","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2013-6629","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2013-6629","date":"2026-11-02","epss":0.0973,"percentile":0.95519}],"urls":["http://advisories.mageia.org/MGASA-2013-0333.html","http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html","http://bugs.ghostscript.com/show_bug.cgi?id=686980","http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html","http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html","http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html","http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html","http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html","http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html","http://marc.info/?l=bugtraq&m=140852886808946&w=2","http://marc.info/?l=bugtraq&m=140852974709252&w=2","http://rhn.redhat.com/errata/RHSA-2013-1803.html","http://rhn.redhat.com/errata/RHSA-2013-1804.html","http://secunia.com/advisories/56175","http://secunia.com/advisories/58974","http://secunia.com/advisories/59058","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT6150","http://support.apple.com/kb/HT6162","http://support.apple.com/kb/HT6163","http://www-01.ibm.com/support/docview.wss?uid=swg21672080","http://www-01.ibm.com/support/docview.wss?uid=swg21676746","http://www.debian.org/security/2013/dsa-2799","http://www.mandriva.com/security/advisories?name=MDVSA-2013:273","http://www.mozilla.org/security/announce/2013/mfsa2013-116.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html","http://www.securityfocus.com/bid/63676","http://www.securitytracker.com/id/1029470","http://www.securitytracker.com/id/1029476","http://www.ubuntu.com/usn/USN-2052-1","http://www.ubuntu.com/usn/USN-2053-1","http://www.ubuntu.com/usn/USN-2060-1","https://access.redhat.com/errata/RHSA-2014:0413","https://access.redhat.com/errata/RHSA-2014:0414","https://bugzilla.mozilla.org/show_bug.cgi?id=891693","https://code.google.com/p/chromium/issues/detail?id=258723","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629","https://security.gentoo.org/glsa/201606-03","https://src.chromium.org/viewvc/chrome?revision=229729&view=revision","https://www.ibm.com/support/docview.wss?uid=swg21675973"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2013-6629","description":"The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5351","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5351","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-02-24","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5351","cwe":"CWE-352","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-5351","cwe":"CWE-352","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-5351","date":"2026-11-02","epss":0.09667,"percentile":0.95499}],"risk":4.8335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5351"},"relatedVulnerabilities":[{"id":"CVE-2015-5351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5351","cwe":"CWE-352","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-5351","cwe":"CWE-352","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-5351","date":"2026-11-02","epss":0.09667,"percentile":0.95499}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html","http://rhn.redhat.com/errata/RHSA-2016-1089.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://seclists.org/bugtraq/2016/Feb/148","http://svn.apache.org/viewvc?view=revision&revision=1720652","http://svn.apache.org/viewvc?view=revision&revision=1720655","http://svn.apache.org/viewvc?view=revision&revision=1720658","http://svn.apache.org/viewvc?view=revision&revision=1720660","http://svn.apache.org/viewvc?view=revision&revision=1720661","http://svn.apache.org/viewvc?view=revision&revision=1720663","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.debian.org/security/2016/dsa-3609","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/83330","http://www.securitytracker.com/id/1035069","http://www.ubuntu.com/usn/USN-3024-1","https://access.redhat.com/errata/RHSA-2016:1087","https://access.redhat.com/errata/RHSA-2016:1088","https://bto.bluecoat.com/security-advisory/sa118","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180531-0001/","https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5351","description":"The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-11-02","epss":0.09524,"percentile":0.95454}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"12.22.9"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"],"vulnerabilityID":"CVE-2021-44533","versionConstraint":"< 12.22.9||>= 14.0.0, < 14.18.3||>= 16.0.0, < 16.13.2||>= 17.0.0, < 17.3.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-44533","fix":{"state":"fixed","versions":["12.22.9","14.18.3","16.13.2","17.3.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"12.22.9"},{"date":"2025-09-04","kind":"first-observed","version":"14.18.3"},{"date":"2025-09-04","kind":"first-observed","version":"16.13.2"},{"date":"2025-09-04","kind":"first-observed","version":"17.3.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44533","cwe":"CWE-295","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-44533","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44533","date":"2026-11-02","epss":0.09358,"percentile":0.95392}],"risk":4.749185000000001,"urls":["https://hackerone.com/reports/1429694","https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","https://security.netapp.com/advisory/ntap-20220325-0007/","https://www.debian.org/security/2022/dsa-5170","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","description":"Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable."},"relatedVulnerabilities":[]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10708","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10708","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-11-02","epss":0.15716,"percentile":0.96862}],"risk":4.714799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10708"},"relatedVulnerabilities":[{"id":"CVE-2016-10708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-11-02","epss":0.15716,"percentile":0.96862}],"urls":["http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html","http://www.securityfocus.com/bid/102780","https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.netapp.com/advisory/ntap-20180423-0003/","https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3809-1/","https://www.openssh.com/releasenotes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","description":"sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."}]},{"artifact":{"id":"91e22e3289c39d88","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-5:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/ubuntu/bzip2@1.0.6-5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.list"},{"path":"/var/lib/dpkg/info/bzip2.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.preinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-11-02","epss":0.15685,"percentile":0.96858}],"risk":4.705499999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-11-02","epss":0.15685,"percentile":0.96858}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"f59d1e0c17b85413","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/ubuntu/libbz2-1.0@1.0.6-5?arch=amd64&distro=ubuntu-14.04&upstream=bzip2","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-11-02","epss":0.15685,"percentile":0.96858}],"risk":4.705499999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-11-02","epss":0.15685,"percentile":0.96858}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"854d0a32aa5f8b1e","cpes":["cpe:2.3:a:apache:httpclient:4.2.5:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.5","type":"java-archive","version":"4.2.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/usr/share/java/wagon-http-shaded-2.x.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/usr/share/java/wagon-http-shaded-2.x.jar","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/java/wagon-http-shaded-2.x.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-11-02","epss":0.09032,"percentile":0.95281}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-11-02","epss":0.09032,"percentile":0.95281}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"ec96598ee4148655","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.6.2-1ubuntu2?arch=amd64&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-1ubuntu2.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-1ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-1ubuntu2.1"],"available":[{"date":"2018-08-30","kind":"advisory","version":"2:1.6.2-1ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"risk":4.612,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"f413e30fd70e6608","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.6.2-1ubuntu2?arch=all&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-1ubuntu2.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-1ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-1ubuntu2.1"],"available":[{"date":"2018-08-30","kind":"advisory","version":"2:1.6.2-1ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"risk":4.612,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"01d71893e1755ff6","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-1ubuntu2:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/ubuntu/libx11-xcb1@2%3A1.6.2-1ubuntu2?arch=amd64&distro=ubuntu-14.04&upstream=libx11","type":"deb","version":"2:1.6.2-1ubuntu2","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-1ubuntu2.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-1ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libx11","version":"2:1.6.2-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-1ubuntu2.1"],"available":[{"date":"2018-08-30","kind":"advisory","version":"2:1.6.2-1ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"risk":4.612,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-11-02","epss":0.09224,"percentile":0.95349}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-11-02","epss":0.09205,"percentile":0.95338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"854d0a32aa5f8b1e","cpes":["cpe:2.3:a:apache:httpclient:4.2.5:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.5","type":"java-archive","version":"4.2.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/usr/share/java/wagon-http-shaded-2.x.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/usr/share/java/wagon-http-shaded-2.x.jar","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/java/wagon-http-shaded-2.x.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cfh5-3ghh-wfjx","versionConstraint":"<4.3.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cfh5-3ghh-wfjx","fix":{"state":"fixed","versions":["4.3.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-11-02","epss":0.09189,"percentile":0.95333}],"risk":4.5945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-3577","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2769-1","http://www.openwall.com/lists/oss-security/2021/10/06/1","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122","https://security.netapp.com/advisory/ntap-20231027-0003","https://svn.apache.org/viewvc?view=revision&revision=1614064"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cfh5-3ghh-wfjx","description":"Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-11-02","epss":0.09189,"percentile":0.95333}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"5b22ae430d4ac760","cpes":["cpe:2.3:a:libhttpclient-java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient-java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*"],"name":"libhttpclient-java","purl":"pkg:deb/ubuntu/libhttpclient-java@4.3.3-1?arch=all&distro=ubuntu-14.04&upstream=httpcomponents-client","type":"deb","version":"4.3.3-1","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libhttpclient-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libhttpclient-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.list"}],"upstreams":[{"name":"httpcomponents-client"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.3.3-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-3577","versionConstraint":"< 4.3.3-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"httpcomponents-client","version":"4.3.3-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-3577","fix":{"state":"fixed","versions":["4.3.3-1ubuntu0.1"],"available":[{"date":"2014-08-21","kind":"advisory","version":"4.3.3-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-11-02","epss":0.09189,"percentile":0.95333}],"risk":4.5945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-3577"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-11-02","epss":0.09189,"percentile":0.95333}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"4ced6a17da239544","cpes":["cpe:2.3:a:libnetty-java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty-java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*"],"name":"libnetty-java","purl":"pkg:deb/ubuntu/libnetty-java@1%3A3.2.6.Final-2?arch=all&distro=ubuntu-14.04&upstream=netty","type":"deb","version":"1:3.2.6.Final-2","language":"","licenses":["sha256:637e6b5538594243e93cd1a7c7516fa6c55bc4d6a304434915fa623e69d0156f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.list"}],"upstreams":[{"name":"netty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11612","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"netty","version":"1:3.2.6.Final-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-11612","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-11612","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11612","date":"2026-11-02","epss":0.09188,"percentile":0.95333}],"risk":4.594,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-11612"},"relatedVulnerabilities":[{"id":"CVE-2020-11612","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11612","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11612","date":"2026-11-02","epss":0.09188,"percentile":0.95333}],"urls":["https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final","https://github.com/netty/netty/issues/6168","https://github.com/netty/netty/pull/9924","https://lists.apache.org/thread.html/r14446ed58208cb6d97b6faa6ebf145f1cf2c70c0886c0c133f4d3b6f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r255ed239e65d0596812362adc474bee96caf7ba042c7ad2f3c62cec7%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r281882fdf9ea89aac02fd2f92786693a956aac2ce9840cce87c7df6b%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2958e4d49ee046e1e561e44fdc114a0d2285927501880f15852a9b53%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r31424427cc6d7db46beac481bdeed9a823fc20bb1b9deede38557f71%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3195127e46c87a680b5d1d3733470f83b886bfd3b890c50df718bed1%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3ea4918d20d0c1fa26cac74cc7cda001d8990bc43473d062867ef70d%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4a7e4e23bd84ac24abf30ab5d5edf989c02b555e1eca6a2f28636692%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4f4a14d6a608db447b725ec2e96c26ac9664d83cd879aa21e2cfeb24%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5030cd8ea5df1e64cf6a7b633eff145992fbca03e8bfc687cd2427ab%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5a0b1f0b1c3bcd66f5177fbd6f6de2d0f8cae24a13ab2669f274251a%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5b1ad61552591b747cd31b3a908d5ff2e8f2a8a6847583dd6b7b1ee7%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r69b23a94d4ae45394cabae012dd1f4a963996869c44c478eb1c61082%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r7836bbdbe95c99d4d725199f0c169927d4e87ba57e4beeeb699c097a%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r866288c2ada00ce148b7307cdf869f15f24302b3eb2128af33830997%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r88e2b91560c065ed67e62adf8f401c417e4d70256d11ea447215a70c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8a654f11e1172b0effbfd6f8d5b6ca651ae4ac724a976923c268a42f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9addb580456807cd11d6f0c6b6373b7d7161d06d2278866c30c7febb%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9c30b7fca4baedebcb46d6e0f90071b30cc4a0e074164d50122ec5ec%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra98e3a8541a09271f96478d5e22c7e3bd1afdf48641c8be25d62d9f9%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rd302ddb501fa02c5119120e5fc21df9a1c00e221c490edbe2d7ad365%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/re1ea144e91f03175d661b2d3e97c7d74b912e019613fa90419cf63f4%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ref2c8a0cbb3b8271e5b9a06457ba78ad2028128627186531730f50ef%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ref3943adbc3a8813aee0e3a9dd919bacbb27f626be030a3c6d6c7f83%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/rf803b65b4a57589d79cf2e83d8ece0539018d32864f932f63c972844%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9f8bcc4ca8d2788f77455ff594468404732a4497baebe319043f4d5%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfd173eac20d5e5f581c8984b685c836dafea8eb2f7ff85f617704cf1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rff8859c0d06b1688344b39097f9685c43b461cf2bc41f60f001704e9%40%3Ccommits.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/","https://security.netapp.com/advisory/ntap-20201223-0001/","https://www.debian.org/security/2021/dsa-4885","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11612","description":"The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_251"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2803","versionConstraint":"< 1.7.0_261||>= 1.8, < 1.8.0_251||>= 12, < 14.0.1||>= 7, < 7.0.261||>= 8, < 8.0.251||>= 9, < 11.0.7 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_251"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2803","versionConstraint":"< 1.7.0_261||>= 1.8, < 1.8.0_251||>= 12, < 14.0.1||>= 7, < 7.0.261||>= 8, < 8.0.251||>= 9, < 11.0.7 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_251"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2803","versionConstraint":"< 1.7.0_261||>= 1.8, < 1.8.0_251||>= 12, < 14.0.1||>= 7, < 7.0.261||>= 8, < 8.0.251||>= 9, < 11.0.7 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-2803","fix":{"state":"fixed","versions":["1.7.0_261","7.0.261","1.8.0_251","8.0.251","11.0.7","14.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_261"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_251"},{"date":"2025-09-04","kind":"first-observed","version":"14.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.261"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.251"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-2803","date":"2026-11-02","epss":0.0623,"percentile":0.93541}],"risk":4.589433333333334,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html","https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/","https://security.gentoo.org/glsa/202006-22","https://security.gentoo.org/glsa/202209-15","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4337-1/","https://www.debian.org/security/2020/dsa-4662","https://www.debian.org/security/2020/dsa-4668","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-2803","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.3.24.v20180605"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-84q7-p226-4x5w","versionConstraint":"<=9.3.23.v20180228 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-84q7-p226-4x5w","fix":{"state":"fixed","versions":["9.3.24.v20180605"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.3.24.v20180605"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7656","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2017-7656","date":"2026-11-02","epss":0.06107,"percentile":0.93433}],"risk":4.5802499999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-7656","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6@%3Cissues.maven.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securitytracker.com/id/1041194"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-84q7-p226-4x5w","description":"Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)"},"relatedVulnerabilities":[{"id":"CVE-2017-7656","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7656","cwe":"CWE-444","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2017-7656","date":"2026-11-02","epss":0.06107,"percentile":0.93433}],"urls":["http://www.securitytracker.com/id/1041194","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6%40%3Cissues.maven.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us","https://www.debian.org/security/2018/dsa-4278","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7656","description":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response."}]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-11-02","epss":0.09039,"percentile":0.95282}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"5b22ae430d4ac760","cpes":["cpe:2.3:a:libhttpclient-java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient-java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient_java:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient-java:4.3.3-1:*:*:*:*:*:*:*","cpe:2.3:a:libhttpclient:libhttpclient_java:4.3.3-1:*:*:*:*:*:*:*"],"name":"libhttpclient-java","purl":"pkg:deb/ubuntu/libhttpclient-java@4.3.3-1?arch=all&distro=ubuntu-14.04&upstream=httpcomponents-client","type":"deb","version":"4.3.3-1","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libhttpclient-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libhttpclient-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhttpclient-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libhttpclient-java.list"}],"upstreams":[{"name":"httpcomponents-client"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13956","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"httpcomponents-client","version":"4.3.3-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-13956","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-11-02","epss":0.09032,"percentile":0.95281}],"risk":4.516,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-13956"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-11-02","epss":0.09032,"percentile":0.95281}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"4ced6a17da239544","cpes":["cpe:2.3:a:libnetty-java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty-java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*"],"name":"libnetty-java","purl":"pkg:deb/ubuntu/libnetty-java@1%3A3.2.6.Final-2?arch=all&distro=ubuntu-14.04&upstream=netty","type":"deb","version":"1:3.2.6.Final-2","language":"","licenses":["sha256:637e6b5538594243e93cd1a7c7516fa6c55bc4d6a304434915fa623e69d0156f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.list"}],"upstreams":[{"name":"netty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20444","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"netty","version":"1:3.2.6.Final-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20444","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20444","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20444","date":"2026-11-02","epss":0.08914,"percentile":0.95237}],"risk":4.457,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20444"},"relatedVulnerabilities":[{"id":"CVE-2019-20444","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20444","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-20444","date":"2026-11-02","epss":0.08914,"percentile":0.95237}],"urls":["https://access.redhat.com/errata/RHSA-2020:0497","https://access.redhat.com/errata/RHSA-2020:0567","https://access.redhat.com/errata/RHSA-2020:0601","https://access.redhat.com/errata/RHSA-2020:0605","https://access.redhat.com/errata/RHSA-2020:0606","https://access.redhat.com/errata/RHSA-2020:0804","https://access.redhat.com/errata/RHSA-2020:0805","https://access.redhat.com/errata/RHSA-2020:0806","https://access.redhat.com/errata/RHSA-2020:0811","https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final","https://github.com/netty/netty/issues/9866","https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-20444/5.0.0.Alpha1/exploit","https://lists.apache.org/thread.html/r059b042bca47be53ff8a51fd04d95eb01bb683f1afa209db136e8cb7@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E","https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d@%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r34912a9b1a5c269a77b8be94ef6fb6d1e9b3c69129719dc00f01cf0b@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r489886fe72a98768eed665474cba13bad8d6fe0654f24987706636c5@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f@%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html","https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/","https://usn.ubuntu.com/4532-1/","https://www.debian.org/security/2021/dsa-4885","https://lists.apache.org/thread.html/r059b042bca47be53ff8a51fd04d95eb01bb683f1afa209db136e8cb7%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e%40%3Ccommits.camel.apache.org%3E","https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0f5e72d5f69b4720dfe64fcbc2da9afae949ed1e9cbffa84bb7d92d7%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d%40%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r34912a9b1a5c269a77b8be94ef6fb6d1e9b3c69129719dc00f01cf0b%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r489886fe72a98768eed665474cba13bad8d6fe0654f24987706636c5%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4c675b2d0cc2a5e506b11ee10d60a378859ee340aca052e4c7ef4749%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r91e0fa345c86c128b75a4a791b4b503b53173ff4c13049ac7129d319%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f%40%3Cdev.geode.apache.org%3E","https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114%40%3Ccommits.druid.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20444","description":"HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\""}]},{"artifact":{"id":"0623e9a2db44c0e7","cpes":["cpe:2.3:a:libllvm3.4:libllvm3.4:1\\:3.4-1ubuntu3:*:*:*:*:*:*:*"],"name":"libllvm3.4","purl":"pkg:deb/ubuntu/libllvm3.4@1%3A3.4-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=llvm-toolchain-3.4","type":"deb","version":"1:3.4-1ubuntu3","language":"","licenses":["sha256:ea6930343f42566455a3b210d6237a76b3d84c6441a64d7c2585da517ca42345"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libllvm3.4/copyright","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/usr/share/doc/libllvm3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libllvm3.4:amd64.md5sums","layerID":"sha256:65e199937d1f53564c7fa8ba766da6c5216b2453f4fa7c14d4ace43a3a552e16","accessPath":"/var/lib/dpkg/info/libllvm3.4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"llvm-toolchain-3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-2305","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"llvm-toolchain-3.4","version":"1:3.4-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-2305","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-2305","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2305","date":"2026-11-02","epss":0.08883,"percentile":0.95224}],"risk":4.4415000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-2305"},"relatedVulnerabilities":[{"id":"CVE-2015-2305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-2305","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-2305","date":"2026-11-02","epss":0.08883,"percentile":0.95224}],"urls":["http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html","http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html","http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html","http://marc.info/?l=bugtraq&m=143403519711434&w=2","http://openwall.com/lists/oss-security/2015/02/07/14","http://openwall.com/lists/oss-security/2015/03/11/8","http://php.net/ChangeLog-5.php","http://rhn.redhat.com/errata/RHSA-2015-1053.html","http://rhn.redhat.com/errata/RHSA-2015-1066.html","http://www.debian.org/security/2015/dsa-3195","http://www.kb.cert.org/vuls/id/695940","http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","http://www.securityfocus.com/bid/72611","http://www.securitytracker.com/id/1031947","http://www.ubuntu.com/usn/USN-2572-1","http://www.ubuntu.com/usn/USN-2594-1","https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/","https://support.apple.com/HT205267"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-2305","description":"Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0099","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0099","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2014-05-31","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0099","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0099","date":"2026-11-02","epss":0.08838,"percentile":0.95197}],"risk":4.419,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0099"},"relatedVulnerabilities":[{"id":"CVE-2014-0099","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0099","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0099","date":"2026-11-02","epss":0.08838,"percentile":0.95197}],"urls":["http://advisories.mageia.org/MGASA-2014-0268.html","http://linux.oracle.com/errata/ELSA-2014-0865.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html","http://marc.info/?l=bugtraq&m=141017844705317&w=2","http://marc.info/?l=bugtraq&m=141390017113542&w=2","http://marc.info/?l=bugtraq&m=144498216801440&w=2","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://seclists.org/fulldisclosure/2014/Dec/23","http://seclists.org/fulldisclosure/2014/May/138","http://seclists.org/fulldisclosure/2014/May/140","http://secunia.com/advisories/59121","http://secunia.com/advisories/59678","http://secunia.com/advisories/59732","http://secunia.com/advisories/59835","http://secunia.com/advisories/59849","http://secunia.com/advisories/59873","http://secunia.com/advisories/60729","http://secunia.com/advisories/60793","http://svn.apache.org/viewvc?view=revision&revision=1578812","http://svn.apache.org/viewvc?view=revision&revision=1578814","http://svn.apache.org/viewvc?view=revision&revision=1580473","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www-01.ibm.com/support/docview.wss?uid=swg21678231","http://www-01.ibm.com/support/docview.wss?uid=swg21680603","http://www-01.ibm.com/support/docview.wss?uid=swg21681528","http://www.debian.org/security/2016/dsa-3447","http://www.debian.org/security/2016/dsa-3530","http://www.mandriva.com/security/advisories?name=MDVSA-2015:052","http://www.mandriva.com/security/advisories?name=MDVSA-2015:053","http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.securityfocus.com/archive/1/532218/100/0/threaded","http://www.securityfocus.com/archive/1/532221/100/0/threaded","http://www.securityfocus.com/archive/1/534161/100/0/threaded","http://www.securityfocus.com/bid/67668","http://www.securitytracker.com/id/1030302","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0099","description":"Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_221"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-7317","versionConstraint":"< 1.7.0_231||>= 1.8, < 1.8.0_221||>= 1.9, < 7.0.231||>= 12, < 12.0.2||>= 8, < 8.0.221||>= 9, < 11.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_221"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-7317","versionConstraint":"< 1.7.0_231||>= 1.8, < 1.8.0_221||>= 1.9, < 7.0.231||>= 12, < 12.0.2||>= 8, < 8.0.221||>= 9, < 11.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_221"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-7317","versionConstraint":"< 1.7.0_231||>= 1.8, < 1.8.0_221||>= 1.9, < 7.0.231||>= 12, < 12.0.2||>= 8, < 8.0.221||>= 9, < 11.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-7317","fix":{"state":"fixed","versions":["1.7.0_231","7.0.231","1.8.0_221","8.0.221","11.0.4","12.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_231"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_221"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.231"},{"date":"2025-09-04","kind":"first-observed","version":"12.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.221"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-7317","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-7317","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-7317","date":"2026-11-02","epss":0.09393,"percentile":0.95408}],"risk":4.4147099999999995,"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html","http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html","http://www.securityfocus.com/bid/108098","https://access.redhat.com/errata/RHSA-2019:1265","https://access.redhat.com/errata/RHSA-2019:1267","https://access.redhat.com/errata/RHSA-2019:1269","https://access.redhat.com/errata/RHSA-2019:1308","https://access.redhat.com/errata/RHSA-2019:1309","https://access.redhat.com/errata/RHSA-2019:1310","https://access.redhat.com/errata/RHSA-2019:2494","https://access.redhat.com/errata/RHSA-2019:2495","https://access.redhat.com/errata/RHSA-2019:2585","https://access.redhat.com/errata/RHSA-2019:2590","https://access.redhat.com/errata/RHSA-2019:2592","https://access.redhat.com/errata/RHSA-2019:2737","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803","https://github.com/glennrp/libpng/issues/275","https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html","https://seclists.org/bugtraq/2019/Apr/30","https://seclists.org/bugtraq/2019/Apr/36","https://seclists.org/bugtraq/2019/May/56","https://seclists.org/bugtraq/2019/May/59","https://seclists.org/bugtraq/2019/May/67","https://security.gentoo.org/glsa/201908-02","https://security.netapp.com/advisory/ntap-20190719-0005/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us","https://usn.ubuntu.com/3962-1/","https://usn.ubuntu.com/3991-1/","https://usn.ubuntu.com/3997-1/","https://usn.ubuntu.com/4080-1/","https://usn.ubuntu.com/4083-1/","https://www.debian.org/security/2019/dsa-4435","https://www.debian.org/security/2019/dsa-4448","https://www.debian.org/security/2019/dsa-4451","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://openjdk.org/groups/vulnerability/advisories/2019-07-16","https://www.mozilla.org/en-US/security/advisories/mfsa2019-13","https://www.mozilla.org/en-US/security/advisories/mfsa2019-14","https://www.mozilla.org/en-US/security/advisories/mfsa2019-15"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-7317","description":"png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute."},"relatedVulnerabilities":[]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-4ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9233","versionConstraint":"< 2.1.0-4ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9233","fix":{"state":"fixed","versions":["2.1.0-4ubuntu1.4"],"available":[{"date":"2017-07-19","kind":"advisory","version":"2.1.0-4ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-11-02","epss":0.08739,"percentile":0.95155}],"risk":4.3694999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9233"},"relatedVulnerabilities":[{"id":"CVE-2017-9233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-11-02","epss":0.08739,"percentile":0.95155}],"urls":["http://www.debian.org/security/2017/dsa-3898","http://www.openwall.com/lists/oss-security/2017/06/17/7","http://www.securityfocus.com/bid/99276","http://www.securitytracker.com/id/1039427","https://github.com/libexpat/libexpat/blob/master/expat/Changes","https://libexpat.github.io/doc/cve-2017-9233/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://support.f5.com/csp/article/K03244804"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9233","description":"XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD."}]},{"artifact":{"id":"a55d04cf1fee804c","cpes":["cpe:2.3:a:libprocps3:libprocps3:1\\:3.3.9-1ubuntu2.2:*:*:*:*:*:*:*"],"name":"libprocps3","purl":"pkg:deb/ubuntu/libprocps3@1%3A3.3.9-1ubuntu2.2?arch=amd64&distro=ubuntu-14.04&upstream=procps","type":"deb","version":"1:3.3.9-1ubuntu2.2","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprocps3/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libprocps3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"procps"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:3.3.9-1ubuntu2.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 1:3.3.9-1ubuntu2.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"procps","version":"1:3.3.9-1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["1:3.3.9-1ubuntu2.3"],"available":[{"date":"2018-05-23","kind":"advisory","version":"1:3.3.9-1ubuntu2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-11-02","epss":0.08738,"percentile":0.95153}],"risk":4.369,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-11-02","epss":0.08738,"percentile":0.95153}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"5dca10c0e73a9ccd","cpes":["cpe:2.3:a:procps:procps:1\\:3.3.9-1ubuntu2.2:*:*:*:*:*:*:*"],"name":"procps","purl":"pkg:deb/ubuntu/procps@1%3A3.3.9-1ubuntu2.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:3.3.9-1ubuntu2.2","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/procps/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/procps/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.list"},{"path":"/var/lib/dpkg/info/procps.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.postinst"},{"path":"/var/lib/dpkg/info/procps.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.postrm"},{"path":"/var/lib/dpkg/info/procps.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.preinst"},{"path":"/var/lib/dpkg/info/procps.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/procps.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:3.3.9-1ubuntu2.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 1:3.3.9-1ubuntu2.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"procps","version":"1:3.3.9-1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["1:3.3.9-1ubuntu2.3"],"available":[{"date":"2018-05-23","kind":"advisory","version":"1:3.3.9-1ubuntu2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-11-02","epss":0.08738,"percentile":0.95153}],"risk":4.369,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-11-02","epss":0.08738,"percentile":0.95153}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1351","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1351","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1351","date":"2026-11-02","epss":0.08718,"percentile":0.9514}],"risk":4.359,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1351"},"relatedVulnerabilities":[{"id":"CVE-2019-1351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1351","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1351","date":"2026-11-02","epss":0.08718,"percentile":0.9514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1351","description":"A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1351","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1351","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1351","date":"2026-11-02","epss":0.08718,"percentile":0.9514}],"risk":4.359,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1351"},"relatedVulnerabilities":[{"id":"CVE-2019-1351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1351","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1351","date":"2026-11-02","epss":0.08718,"percentile":0.9514}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1351","description":"A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'."}]},{"artifact":{"id":"3e827d2988450660","cpes":["cpe:2.3:a:org.eclipse.jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:org.eclipse.jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty-server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty-server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty_server:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty_server:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:8.1.14.v20131031:*:*:*:*:*:*:*","cpe:2.3:a:jetty:jetty:8.1.14.v20131031:*:*:*:*:*:*:*"],"name":"jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server@8.1.14.v20131031","type":"java-archive","version":"8.1.14.v20131031","language":"java","licenses":[],"metadata":{"pomGroupID":"org.eclipse.jetty","virtualPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar:org.eclipse.jetty:jetty-server","manifestName":"","pomArtifactID":"jetty-server","archiveDigests":null},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/lib/missioncontrol/plugins/org.eclipse.jetty.server_8.1.14.v20131031.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.2.22.v20170606"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wfcc-pff6-rgc5","versionConstraint":"<=9.2.21.v20170120 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.eclipse.jetty:jetty-server","version":"8.1.14.v20131031"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wfcc-pff6-rgc5","fix":{"state":"fixed","versions":["9.2.22.v20170606"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"9.2.22.v20170606"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9735","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9735","date":"2026-11-02","epss":0.05795,"percentile":0.93119}],"risk":4.34625,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-9735","https://github.com/eclipse/jetty.project/issues/1556","https://bugs.debian.org/864631","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e668f5947b5457dc02","https://web.archive.org/web/20170826163336/http://www.securityfocus.com/bid/99104"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wfcc-pff6-rgc5","description":"Jetty vulnerable to exposure of sensitive information due to observable discrepancy"},"relatedVulnerabilities":[{"id":"CVE-2017-9735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9735","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9735","date":"2026-11-02","epss":0.05795,"percentile":0.93119}],"urls":["http://www.securityfocus.com/bid/99104","https://bugs.debian.org/864631","https://github.com/eclipse/jetty.project/issues/1556","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9735","description":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords."}]},{"artifact":{"id":"d3060ff66f6b7c47","cpes":["cpe:2.3:a:maven:maven:3.0.5-1:*:*:*:*:*:*:*"],"name":"maven","purl":"pkg:deb/ubuntu/maven@3.0.5-1?arch=all&distro=ubuntu-14.04","type":"deb","version":"3.0.5-1","language":"","licenses":["Apache-2.0","GPL-2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/maven/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/maven/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/maven.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/maven.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/maven.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/maven.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/maven.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/maven.list"},{"path":"/var/lib/dpkg/info/maven.postinst","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/maven.postinst"},{"path":"/var/lib/dpkg/info/maven.prerm","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/maven.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-26291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"maven","version":"3.0.5-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-26291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-26291","cwe":"CWE-346","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-26291","date":"2026-11-02","epss":0.08691,"percentile":0.9513}],"risk":4.3455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-26291"},"relatedVulnerabilities":[{"id":"CVE-2021-26291","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-26291","cwe":"CWE-346","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-26291","date":"2026-11-02","epss":0.08691,"percentile":0.9513}],"urls":["http://www.openwall.com/lists/oss-security/2021/04/23/5","https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8aff5ee9bac7854d64736%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c%40%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/r07a89b32783f73bda6903c1f9aadeb859e5bef0a4daed6d87db8e4a9%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r0a5e4ff2a7ca7ad8595d7683afbaeb3b8788ba974681907f97e7dc8e%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r0d083314aa3934dd4b6e6970d1f6ee50f6eaa9d867deb2cd96788478%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r30e9fcba679d164158cc26236704c351954909c18cb2485d11038aa6%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r340e75c9bb6e8661b89e1cf2c52f4638a18312e57bd884722bc28f52%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r39fa6ec4b7e912d3e04ea68efd23e554ec9c8efa2c96f5b45104fc61%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867a75c8aa2493ea82732381%40%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r52c6cda14dc6315dc79e72d30109f4589e9c6300ef6dc1a019da32d4%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r53cd5de57aaa126038c5301d8f518f3defab3c5b1c7e17c97bad08d8%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r5ae6aaa8a2ce86145225c3516bb45d315c0454e3765d651527e5df8a%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/r71bc13669be84c2ff45b74a67929bc2da905c152e12a39b406e3c2a0%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r7212b874e575e59d648980d91bc22e684906aee9b211ab92da9591f5%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r74329c671df713f61ae4620ee2452a0443ccad7f33c60e8ed7d21ff9%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b94%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r78fb6d2cf0ca332cfa43abd4471e75fa6c517ed9cdfcb950bff48d40%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r86aebd0387ae19b740b3eb28bad83fe6aceca0d6257eaa810a6e0002%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/r86e1c81e03f441855f127980e9b3d41939d04a7caea2b7ab718e2288%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r96cc126d3ee9aa42af9d3bb4baa94828b0a5f656584a50dcc594125f%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E","https://lists.apache.org/thread.html/ra88a0eba7f84658cefcecc0143fd8bbad52c229ee5dfcbfdde7b6457%40%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/ra9d984eccfd2ae7726671e025f0296bf03786e5cdf872138110ac29b%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rc7ae2530063d1cd1cf8e9fa130d10940760f927168d4063d23b8cd0a%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271c%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/rcd37d9214b08067a2e8f2b5b4fd123a1f8cb6008698d11ef44028c21%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/rcd6c3a36f1dbc130da1b89d0f320db7040de71661a512695a8d513ac%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rdcbad6d8ce72c79827ed8c635f9a62dd919bb21c94a0b64cab2efc31%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/re75f8b3dbc5faa1640908f87e644d373e00f8b4e6ba3e2ba4bd2c80b%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/red3bf6cbfd99e36b0c0a4fa1cea1eef1eb300c6bd8f372f497341265%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de22402%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/rfc0db1f3c375087e69a239f9284ded72d04fbb55849eadde58fa9dc2%40%3Cissues.karaf.apache.org%3E","https://lists.apache.org/thread.html/rfc27e2727a20a574f39273e0432aa97486a332f9b3068f6ac1346594%40%3Cdev.myfaces.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.whitesourcesoftware.com/resources/blog/maven-security-vulnerability-cve-2021-26291/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26291","description":"Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html"}]},{"artifact":{"id":"4ced6a17da239544","cpes":["cpe:2.3:a:libnetty-java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty-java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty_java:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty-java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*","cpe:2.3:a:libnetty:libnetty_java:1\\:3.2.6.Final-2:*:*:*:*:*:*:*"],"name":"libnetty-java","purl":"pkg:deb/ubuntu/libnetty-java@1%3A3.2.6.Final-2?arch=all&distro=ubuntu-14.04&upstream=netty","type":"deb","version":"1:3.2.6.Final-2","language":"","licenses":["sha256:637e6b5538594243e93cd1a7c7516fa6c55bc4d6a304434915fa623e69d0156f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libnetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libnetty-java.list"}],"upstreams":[{"name":"netty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16869","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"netty","version":"1:3.2.6.Final-2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-16869","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16869","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16869","date":"2026-11-02","epss":0.08645,"percentile":0.95112}],"risk":4.3225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-16869"},"relatedVulnerabilities":[{"id":"CVE-2019-16869","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16869","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16869","date":"2026-11-02","epss":0.08645,"percentile":0.95112}],"urls":["https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final","https://github.com/netty/netty/issues/9571","https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-16869/5.0.0.Alpha1/exploit","https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd6c639d@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2e1cf538b502713c2c42ffa46d81f4688edb5676eb55bd9fc4b4fed7@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/35961d1ae00849974353a932b4fef12ebce074541552eceefa04f1fd@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/37ed432b8eb35d8bd757f53783ec3e334bd51f514534432bea7f1c3d@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/380f6d2730603a2cd6b0a8bea9bcb21a86c199147e77e448c5f7390b@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af422569d@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/51923a9ba513b2e816e02a9d1fd8aa6f12e3e4e99bbd9dc884bccbbe@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6063699b87b501ecca8dd3b0e82251bfc85f29363a9b46ac5ace80cf@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/64b10f49c68333aaecf00348c5670fe182e49fd60d45c4a3ab241f8b@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/681493a2f9b63f5b468f741d88d1aa51b2cfcf7a1c5b74ea8c4343fb@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eead6d55b@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f6a3c79@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/799eb85d67cbddc1851a3e63a07b55e95b2f44f1685225d38570ce89@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/860acce024d79837e963a51a42bab2cef8e8d017aad2b455ecd1dcf0@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55debbd0@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/a0f77c73af32cbe4ff0968bfcbbe80ae6361f3dccdd46f3177547266@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/af6e9c2d716868606523857a4cd7a5ee506e6d1710f5fb0d567ec030@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b264fa5801e87698e9f43f2b5585fbc5ebdc26c6f4aad861b258fb69@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b2cd51795f938632c6f60a4c59d9e587fbacd7f7d0e0a3684850a30f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b3dda6399a0ea2b647624b899fd330fca81834e41b13e3e11e1002d8@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b3ddeebbfaf8a288d7de8ab2611cf2609ab76b9809f0633248546b7c@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/bdf7a5e597346a75d2d884ca48c767525e35137ad59d8f10b8fc943c@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/cbf6e6a04cb37e9320ad20e437df63beeab1755fc0761918ed5c5a6e@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/cf5aa087632ead838f8ac3a42e9837684e7afe6e0fcb7704e0c73bc0@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/d14f721e0099b914daebe29bca199fde85d8354253be9d6d3d46507a@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d01b6a54@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/d7d530599dc7813056c712213e367b68cdf56fb5c9b73f864870bc4c@%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/e192fe8797c192679759ffa6b15e4d0806546945a41d8ebfbc6ee3ac@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628d67769@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ee6faea9e542c0b90afd70297a9daa203e20d41aa2ac7fca6703662f@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/f6c5ebfb018787c764f000362d59e4b231c0a36b6253aa866de8c64e@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e@%3Ccommits.camel.apache.org%3E","https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3225f7dfe6b8a37e800ecb8e31abd7ac6c4312dbd3223dd8139c37bb@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r73c400ab66d79821dec9e3472f0e2c048d528672bdb0f8bf44d7cb1f@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc@%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a@%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833@%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9@%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f@%3Cdev.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00035.html","https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html","https://seclists.org/bugtraq/2020/Jan/6","https://usn.ubuntu.com/4532-1/","https://www.debian.org/security/2020/dsa-4597","https://lists.apache.org/thread.html/0acadfb96176768caac79b404110df62d14d30aa9d53b6dbdb1407ac%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/19fed892608db1efe5a5ce14372137669ff639df0205323959af7de3%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/2494a2ac7f66af6e4646a4937b17972a4ec7cd3c7333c66ffd6c639d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2e1cf538b502713c2c42ffa46d81f4688edb5676eb55bd9fc4b4fed7%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/35961d1ae00849974353a932b4fef12ebce074541552eceefa04f1fd%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/37ed432b8eb35d8bd757f53783ec3e334bd51f514534432bea7f1c3d%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/380f6d2730603a2cd6b0a8bea9bcb21a86c199147e77e448c5f7390b%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/3e6d7aae1cca10257e3caf2d69b22f74c875f12a1314155af422569d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/51923a9ba513b2e816e02a9d1fd8aa6f12e3e4e99bbd9dc884bccbbe%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6063699b87b501ecca8dd3b0e82251bfc85f29363a9b46ac5ace80cf%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/64b10f49c68333aaecf00348c5670fe182e49fd60d45c4a3ab241f8b%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/681493a2f9b63f5b468f741d88d1aa51b2cfcf7a1c5b74ea8c4343fb%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/6e1e34c0d5635a987d595df9e532edac212307243bb1b49eead6d55b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/76540c8b0ed761bfa6c81fa28c13057f13a5448aed079d656f6a3c79%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/799eb85d67cbddc1851a3e63a07b55e95b2f44f1685225d38570ce89%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/860acce024d79837e963a51a42bab2cef8e8d017aad2b455ecd1dcf0%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/9128111213b7b734ffc85db08d8f789b00a85a7f241b708e55debbd0%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/a0f77c73af32cbe4ff0968bfcbbe80ae6361f3dccdd46f3177547266%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/af6e9c2d716868606523857a4cd7a5ee506e6d1710f5fb0d567ec030%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b264fa5801e87698e9f43f2b5585fbc5ebdc26c6f4aad861b258fb69%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b2cd51795f938632c6f60a4c59d9e587fbacd7f7d0e0a3684850a30f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b3dda6399a0ea2b647624b899fd330fca81834e41b13e3e11e1002d8%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/b3ddeebbfaf8a288d7de8ab2611cf2609ab76b9809f0633248546b7c%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/bdf7a5e597346a75d2d884ca48c767525e35137ad59d8f10b8fc943c%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/cbf6e6a04cb37e9320ad20e437df63beeab1755fc0761918ed5c5a6e%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/cf5aa087632ead838f8ac3a42e9837684e7afe6e0fcb7704e0c73bc0%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/d14f721e0099b914daebe29bca199fde85d8354253be9d6d3d46507a%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/d3eb0dbea75ef5c400bd49dfa1901ad50be606cca3cb29e0d01b6a54%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/d7d530599dc7813056c712213e367b68cdf56fb5c9b73f864870bc4c%40%3Cdev.olingo.apache.org%3E","https://lists.apache.org/thread.html/e192fe8797c192679759ffa6b15e4d0806546945a41d8ebfbc6ee3ac%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e39931d7cdd17241e69a0a09a89d99d7435bcc59afee8a9628d67769%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ee6faea9e542c0b90afd70297a9daa203e20d41aa2ac7fca6703662f%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/f6c5ebfb018787c764f000362d59e4b231c0a36b6253aa866de8c64e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0aa8b28e76ec01c697b15e161e6797e88fc8d406ed762e253401106e%40%3Ccommits.camel.apache.org%3E","https://lists.apache.org/thread.html/r0c3d49bfdbc62fd3915676433cc5899c5506d06da1c552ef1b7923a5%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3225f7dfe6b8a37e800ecb8e31abd7ac6c4312dbd3223dd8139c37bb%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r73c400ab66d79821dec9e3472f0e2c048d528672bdb0f8bf44d7cb1f%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc%40%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8402d67fdfe9cf169f859d52a7670b28a08eff31e54b522cc1432532%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r86befa74c5cd1482c711134104aec339bf7ae879f2c4437d7ec477d4%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r90030b0117490caed526e57271bf4d7f9b012091ac5083c895d16543%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a%40%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/rb3361f6c6a5f834ad3db5e998c352760d393c0891b8d3bea90baa836%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rc7eb5634b71d284483e58665b22bf274a69bd184d9bd7ede52015d91%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcb2c59428f34d4757702f9ae739a8795bda7bea97b857e708a9c62c6%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833%40%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rdd5d243a5f8ed8b83c0104e321aa420e5e98792a95749e3c9a54c0b9%40%3Ccommon-commits.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re0b78a3d0a4ba2cf9f4e14e1d05040bde9051d5c78071177186336c9%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7fbd83d0769285b41e948%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/re78eaef7d01ad65c370df30e45c686fffff00b37f7bfd78b26a08762%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf2bf8e2eb0a03227f5bc100b544113f8cafea01e887bb068e8d1fa41%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16869","description":"Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling."}]},{"artifact":{"id":"fb0a7f396765b5e6","cpes":["cpe:2.3:a:rsync:rsync:3.1.0-2ubuntu0.2:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.1.0-2ubuntu0.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.1.0-2ubuntu0.2","language":"","licenses":["sha256:c2efd6affeaf6cc09006394f8575fa84a6c960720f6e1cf90268d0f9649c8009"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-12085","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"rsync","version":"3.1.0-2ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-12085","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-12085","cwe":"CWE-908","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-12085","cwe":"CWE-908","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12085","date":"2026-11-02","epss":0.08641,"percentile":0.95107}],"risk":4.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-12085"},"relatedVulnerabilities":[{"id":"CVE-2024-12085","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12085","cwe":"CWE-908","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-12085","cwe":"CWE-908","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12085","date":"2026-11-02","epss":0.08641,"percentile":0.95107}],"urls":["https://access.redhat.com/errata/RHBA-2025:6470","https://access.redhat.com/errata/RHSA-2024:6122","https://access.redhat.com/errata/RHSA-2025:0324","https://access.redhat.com/errata/RHSA-2025:0325","https://access.redhat.com/errata/RHSA-2025:0637","https://access.redhat.com/errata/RHSA-2025:0688","https://access.redhat.com/errata/RHSA-2025:0714","https://access.redhat.com/errata/RHSA-2025:0774","https://access.redhat.com/errata/RHSA-2025:0787","https://access.redhat.com/errata/RHSA-2025:0790","https://access.redhat.com/errata/RHSA-2025:0849","https://access.redhat.com/errata/RHSA-2025:0884","https://access.redhat.com/errata/RHSA-2025:0885","https://access.redhat.com/errata/RHSA-2025:1120","https://access.redhat.com/errata/RHSA-2025:1123","https://access.redhat.com/errata/RHSA-2025:1128","https://access.redhat.com/errata/RHSA-2025:1225","https://access.redhat.com/errata/RHSA-2025:1227","https://access.redhat.com/errata/RHSA-2025:1242","https://access.redhat.com/errata/RHSA-2025:1451","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:2701","https://access.redhat.com/security/cve/CVE-2024-12085","https://bugzilla.redhat.com/show_bug.cgi?id=2330539","https://kb.cert.org/vuls/id/952657","https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html","https://security.netapp.com/advisory/ntap-20250131-0002/","https://www.kb.cert.org/vuls/id/952657","https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12085","description":"A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time."}]},{"artifact":{"id":"e4765f78ed760068","cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*","cpe:2.3:a:substack:minimist:0.0.8:*:*:*:*:*:*:*"],"name":"minimist","purl":"pkg:npm/minimist@0.0.8","type":"npm","version":"0.0.8","language":"javascript","licenses":["MIT"],"locations":[{"path":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/mkdirp/node_modules/minimist/package.json","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/lib/node_modules/npm/node_modules/mkdirp/node_modules/minimist/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"0.2.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":"<0.2.4 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"minimist","version":"0.0.8"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-xvch-5gv4-984h","fix":{"state":"fixed","versions":["0.2.4"],"available":[{"date":"2023-03-01","kind":"first-observed","version":"0.2.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44906","date":"2026-11-02","epss":0.04581,"percentile":0.91634}],"risk":4.30614,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"severity":"Critical","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","description":"Prototype Pollution in minimist"},"relatedVulnerabilities":[{"id":"CVE-2021-44906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44906","date":"2026-11-02","epss":0.04581,"percentile":0.91634}],"urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95)."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2086","versionConstraint":"= 0.10.0||= 0.10.1||= 0.10.10||= 0.10.11||= 0.10.12||= 0.10.13||= 0.10.14||= 0.10.15||= 0.10.16||= 0.10.16-isaacs-manual||= 0.10.17||= 0.10.18||= 0.10.19||= 0.10.2||= 0.10.20||= 0.10.21||= 0.10.22||= 0.10.23||= 0.10.24||= 0.10.25||= 0.10.26||= 0.10.27||= 0.10.28||= 0.10.29||= 0.10.3||= 0.10.30||= 0.10.31||= 0.10.32||= 0.10.33||= 0.10.34||= 0.10.35||= 0.10.36||= 0.10.37||= 0.10.38||= 0.10.39||= 0.10.4||= 0.10.40||= 0.10.41||= 0.10.5||= 0.10.6||= 0.10.7||= 0.10.8||= 0.10.9||= 0.12.0||= 0.12.1||= 0.12.2||= 0.12.3||= 0.12.4||= 0.12.5||= 0.12.6||= 0.12.7||= 0.12.8||= 0.12.9||= 4.0.0||= 4.1.0||= 4.1.1||= 4.1.2||= 4.2.0||= 4.2.1||= 4.2.2||= 4.2.3||= 4.2.4||= 4.2.5||= 4.2.6||= 5.0.0||= 5.1.0||= 5.1.1||= 5.2.0||= 5.3.0||= 5.4.0||= 5.4.1||= 5.5.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2086","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2086","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2086","date":"2026-11-02","epss":0.06257,"percentile":0.93566}],"risk":4.3016875,"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html","http://www.securityfocus.com/bid/83282","https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/","https://security.gentoo.org/glsa/201612-43"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2086","description":"Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35556","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35556","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35556","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35556","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13","17.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35556","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35556","date":"2026-11-02","epss":0.08395,"percentile":0.94983}],"risk":4.2814499999999995,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-5000","https://www.debian.org/security/2021/dsa-5012","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35556","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"risk":4.2715000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-11-02","epss":0.08543,"percentile":0.95059}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21293","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21293","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21293","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-21293","fix":{"state":"fixed","versions":["1.7.0_331","7.0.331","1.8.0_321","8.0.321","11.0.14","17.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_331"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.331"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.14"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-21293","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-21293","date":"2026-11-02","epss":0.08346,"percentile":0.94957}],"risk":4.235595000000001,"urls":["https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20220121-0007/","https://www.debian.org/security/2022/dsa-5057","https://www.debian.org/security/2022/dsa-5058","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21293","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"risk":4.1865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-558014.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"risk":4.1865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-558014.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"risk":4.1865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-11-02","epss":0.08373,"percentile":0.9497}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-558014.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"d4c3653052dc4012","cpes":["cpe:2.3:a:libjetty-java:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty-java:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty_java:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty_java:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty:libjetty-java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libjetty:libjetty_java:6.1.26-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libjetty-java","purl":"pkg:deb/ubuntu/libjetty-java@6.1.26-1ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=jetty","type":"deb","version":"6.1.26-1ubuntu1.1","language":"","licenses":["Apache-2.0","LGPL-2","other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjetty-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libjetty-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjetty-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjetty-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjetty-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libjetty-java.list"}],"upstreams":[{"name":"jetty"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-27218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"jetty","version":"6.1.26-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-27218","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-27218","cwe":"CWE-226","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2020-27218","date":"2026-11-02","epss":0.08277,"percentile":0.94915}],"risk":4.1385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-27218"},"relatedVulnerabilities":[{"id":"CVE-2020-27218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27218","cwe":"CWE-226","type":"Secondary","source":"emo@eclipse.org"}],"epss":[{"cve":"CVE-2020-27218","date":"2026-11-02","epss":0.08277,"percentile":0.94915}],"urls":["https://bugs.eclipse.org/bugs/show_bug.cgi?id=568892","https://github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8","https://lists.apache.org/thread.html/r00858fe27ee35ac8fa0e1549d67e0efb789d63b791b5300390bd8480%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r01806ad8c9cb0590584baf5b1a60237ad92e4ad5bba082ca04d98179%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r05b7ffde2b8c180709e14bc9ca036407bea3ed9f09b32c4705d23a4a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r078c1203e48089b2c934b9f86b61bebe8c049e0ea6273b124f349988%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r0d2de2ab5558da68b504bd30db74da1d97dc152a857f5b7e462288ab%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r153fbefc27a1b2033692f32ef728ca909a7c7bcc1d21b6c35b38bdd5%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r15500b77c52390e2ec048cea4a6b45edf907ea61cd13259193ff8601%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r186748e676e5aeb4eb603361e6367555ae4daecbde55cfd69fa68ec6%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r1dd302323c6fe1a542d0371de66a484918fa6c2831ae70d924974bea%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r22776d06582985cca5bd2a92519a2b13b4cae2d8e087318da03c036d%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r23ce6b8965e30808daa77a80fcd69833b1fc632d80465d0419eff619%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r25a47cd06750ebb4b0f23a9b7a57c209702c8566a4c970a41ac088df%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r2a541f08bf5f847394297c13a5305c2f76c11e46504ce2a49653890a%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r2a57c7bbf36afc87f8ad9e1dd2f53a08e85a1b531283fc2efce4fe17%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2f168fd22c071bdd95ec696e45d2a01e928b9fcadbe94fbabeb1549d%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2ffe719224cbe5897f2d06dd22fc77fa12377c39efe9de0c3bf3f837%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r306c8e5aad1b9afc0c9278430fb571950fbb3ab7dd5d369eb618ffa4%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r32a25679d97bf5969d130f8e9b3a3fc54110095397d89952e93dbeb0%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E","https://lists.apache.org/thread.html/r3554a4f192db6008c03f2c6c3e0f1691a9b0d615ce955ef67a876ff7%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3807b1c54066797c4870e03bd2376bdcce9c7c4e6143499f53cd9ca2%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/r391d20ab6ec03d6becc7a9f0c5e0f45a7ad8af6b996ae0a49839f6bd%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r39f1b1be8e5c0935f7c515eedf907909474bad15185125daacb36d50%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r3b7c8bc7a1cb8acdcf7753f436564d289d22f2906e934d1b11de3a40%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r3d43529452c5a16338e8267eb911e8aedc64c3241624302e673961c1%40%3Cdev.hbase.apache.org%3E","https://lists.apache.org/thread.html/r46589f4228aabd5fb16135ff5bef0f77f06cdef64f9785ac3349fa02%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r489dfc3e259ad3837141985dd9291b93e6b40496cdf58808915d67e9%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r4981622ba15e8be1657d30b7c85044c7aabe89751fa7324f8604b834%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4aff5ca6bc94a6f13ff77914fd960185ab70cd6cebe96fffd74543ac%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r4b2e7417a76e3dd4dc9855c6c138c49484080754a09927454f6d89f0%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r500e22d0aedba1866d0b5e76429b76652a473a0209fa8bf66c9f7aab%40%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/r51ec0120b6c849d12fb7fef34db87ef0bf79fcfcd3d703a9800afbba%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r543ea0a861a78d84c22656fb76880d7ab327048cf7ee3ccc7281375d%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r5464405909eb0e1059d5dd57d10c435b9f19325fdebbadb4f1126997%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r5c64173663c71f222ea40617ab362d7a590935fb75c18817fdec377e%40%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/r5e5cb33b545548ec4684d33bd88b05a0ae89c4d7cac93eb63255f58f%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r602683484f607cd1b9598caf3e549fbb01c43fd46a582a32cc3bb545%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6493e43007f41e34cdbbb66622307fa235374dd2ec5bf52c61075a68%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r66456df852de06a0eed2c0a50252a2c8d360b8a5c005f63c0b1e3d25%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6d5bb60a13e8b539600f86cb72097967b951de5c7ef1e4005cda74a7%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r706562cbbdda569cc556d8a7983d1f9229606e7b51337b820785af26%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r70940cb30356642f0c49af49259680d6bd866f51c4e8de0f8a498fb0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r74ab0f5a5f16ca01eb145403ab753df5b348b8c1656d7c8501d0bfc6%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r7669dab41f2b34d56bb67700d869dc9c025ff72e9468204799f5ac29%40%3Ccommits.spark.apache.org%3E","https://lists.apache.org/thread.html/r769e1ba36c607772f7403e7ef2a8ae14d9ddcab4a844f9b28bcf7959%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7d37d33f2d68912985daf40203182e3d86f3e81266b7a7f350689eeb%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r81f82ab8ecb83568bafbecf9ce0e73be73980ac1e2af6baf0f344a59%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r821bbffb64da0f062b4e72d1aa600b91e26bc82a28298ab159121215%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r850d1d0413716e8ba6d910cae7b01a0e560636e17d664769b5080ca5%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r870bc5e6e354c3e28ea029cb5726c9e8dd2b88cb0f5f7de1d4e3133d%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r8b2271909dabb45f0f1482ef35ffe106ae4b0cf8e877eb514e9cd421%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r8be8c6f0e404a3179d988eb8afed03ede5f2d5ce986d3f709fb82610%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8c22aad0711321537183ccddcade7274ebf9dcbdcdacc6c4f90f43de%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r8c839a0d88cd6504abbe72c260371094f47014b2ba08d8d2c0232e3c%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8ed14a84656fa0bb8df3bf9373c5be80f47ceac1e2ff068ee734fdb3%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r8eea4c7797e701f6494c72942dd89f471cda4c2c6e9abbaf05d113d8%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r8f5b144e7a7c2b338f01139d891abbaba12a8173ee01110d21bd0b4d%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8fee46fd9f1254150cc55eecf1ea6a448fca1f7cf1d1e7f9c4803fdb%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r94230f46b91c364d39922a8ba0cfe12b8dba1556b14792719a7d921f%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r942e21ee90e2617a00a08b17b0ac2db961959bec969b91df61584d38%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r964d226dd08527fddd7a44410c50daa9d34d398e5c4793f1d7e19da8%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r96ef6d20c5bd3d42dab500bac56a427e1dce00cf85b083987617643d%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/r990e0296b188d4530d1053882f687fa4f938f108425db2999a180944%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/r9b46505868794fba04d401956304e63e4d8e39bdc118d30e5e87dcd9%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/r9d7a86fb0b45e5b1855d4df83a5820eef813d55eae3edf224f3d5055%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9f571b086965b35d4e91e47fb67c27b42b62762248b4900ba723599f%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra09a653997cbf10aab8c0deabc0fa49f5a8a8ce4305ce9089b98485f%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/ra1c234f045871827f73e4d68326b067e72d3139e109207345fa57d9e%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/racd55c9b704aa68cfb4436f17739b612b5d4f887155e04ed521a4b67%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/racf9e6ad2482cb9b1e3e1b2c1b443d9d5cf14055fb54dec3d2dcce91%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb4ca79d1af5237108ce8770b7c46ca78095f62ef21331d9d06142388%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rb6a3866c02ac4446451c7d9dceab2373b6d32fb058f9085c6143de30%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rb8f413dc923070919b09db3ac87d079a2dcc6f0adfbb029e206a7930%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rba4bca48d2cdfa8c08afc368a9cc4572ec85a5915ba29b8a194bf505%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rbbd003149f929b0e2fe58fb315de1658e98377225632e7e4239323fb%40%3Ccommits.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbc5a8d7a0a13bc8152d427a7e9097cdeb139c6cfe111b2f00f26d16b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbe3f2e0a3c38ed9cbef81507b7cc6e523341865e30dc15c7503adc76%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rbea4d456d88b043be86739ab0200ad06ba5a7921064411c098f79831%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc0e35f4e8a8a36127e3ae7a67f325a3a6a4dbe05034130fb04b6f3b6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc1de630c6ed9a958d9f811e816d6d8efb6ca94aed0869bc5cda9d7f8%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2b603b7fa7f8dbfe0b3b59a6140b4d66868db3bf4b29d69a772d72a%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc91c405c08b529b7292c75d9bd497849db700a1297fe3432990f6774%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rcbc408088ae99dc3167ea293a562a3a9a7295a20e9a1bfc93e43ae1b%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rccc7ba8c51d662e13496df20466d27dbab54d7001e9e7b2f31468a9e%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rce9e232a663d8405c003fe83d5c86c27d1ed65561f3690e824717bc4%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/rcf7b5818f71bb97fd695eb0f54f8f4f69e15cc5f9ec761ea8be0d0d3%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd20651e102cb6742a9d9322ea7b5fc3ab60a7ffecb50fa9157cbf176%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd8e24a3e482e5984bc8c5492dc790413e4fdc1234e3debb94515796b%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd9a960429741406f6557fa344a13d50a0c9976dac2e4c46bb54b32d7%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rdbdbb4e51f8857e082b464cd128decd7263cf0fb8557f12993562c56%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rdde0ad0a03eec962c56b46e70e225918ea2368dcc3fd3488741fad53%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rde11c433675143d8d27551c3d9e821fe1955f1551a518033d3716553%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re014afaa14f4df9d33912ab64dc57249e1c170c7448d7175c6d014ff%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/re03a566114435a8cc8eb72158242b0f560c5eeccbb4ee98d22de8373%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re3918edd403b0d3857a13ef2ccf3d2bc0231f3b8758e2a5777ea1cd3%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/re4ae7ada52c5ecfe805eb86ddc0af399ec8a57bfb0d8c632b8723b88%40%3Cdev.hbase.apache.org%3E","https://lists.apache.org/thread.html/re4e67541a0a25a8589e89f52f8cd163c863fe04b59e048f9f1a04958%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/re86a6ba09dc74e709db843e3561ead923c8fd1cba32343656dd8c44b%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re9214a4232b7ae204288c283bcee4e39f07da6cc34798e9217ba4eb6%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/reb75282901d0969ba6582725ce8672070715d0773f6ff54dedd60156%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/ree677ff289ba9a90850f2e3ba7279555df1a170263ba39c5272db236%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf0181750e321518c8afa8001e0529d50a9447714ef4f58d98af57904%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf273267fa2e49314643af3141cec239f97d41de8a59be4ef7e10c65a%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rf31e24700f725ef81bc5a2e0444a60e1f295ed0a54c0098362a7bdfa%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/rfa34d2a3e423421a4a1354cf457edba2ce78cee2d3ebd8aab151a559%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rfa8879a713480b206c152334419499e6af0878c36217abcc9ab4f0d1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://security.netapp.com/advisory/ntap-20201218-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-27218","description":"In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request."}]},{"artifact":{"id":"43eb9c0e6f5af7b4","cpes":["cpe:2.3:a:gnupg:gnupg:1.4.16-1ubuntu2.4:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@1.4.16-1ubuntu2.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.4.16-1ubuntu2.4","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gnupg.list"},{"path":"/var/lib/dpkg/info/gnupg.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gnupg.postinst"},{"path":"/var/lib/dpkg/info/gnupg.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gnupg.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.16-1ubuntu2.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.5"],"available":[{"date":"2018-06-11","kind":"advisory","version":"1.4.16-1ubuntu2.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-11-02","epss":0.08247,"percentile":0.949}],"risk":4.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-11-02","epss":0.08247,"percentile":0.949}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"9bdf5fa53192a8d3","cpes":["cpe:2.3:a:gpgv:gpgv:1.4.16-1ubuntu2.4:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@1.4.16-1ubuntu2.4?arch=amd64&distro=ubuntu-14.04&upstream=gnupg","type":"deb","version":"1.4.16-1ubuntu2.4","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.16-1ubuntu2.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.5"],"available":[{"date":"2018-06-11","kind":"advisory","version":"1.4.16-1ubuntu2.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-11-02","epss":0.08247,"percentile":0.949}],"risk":4.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-11-02","epss":0.08247,"percentile":0.949}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"8491ed2be6f2e1e9","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.8:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.8?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.8","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-15778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-11-02","epss":0.13675,"percentile":0.96489}],"risk":4.1025,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15778"},"relatedVulnerabilities":[{"id":"CVE-2020-15778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-11-02","epss":0.13675,"percentile":0.96489}],"urls":["https://access.redhat.com/errata/RHSA-2024:3166","https://github.com/cpandya2909/CVE-2020-15778/","https://news.ycombinator.com/item?id=25005567","https://security.gentoo.org/glsa/202212-06","https://security.netapp.com/advisory/ntap-20200731-0007/","https://www.openssh.com/security.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\""}]},{"artifact":{"id":"269c7878aaa65484","cpes":["cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:2.14.7:*:*:*:*:node.js:*:*"],"name":"npm","purl":"pkg:npm/npm@2.14.7","type":"npm","version":"2.14.7","language":"javascript","licenses":["Artistic-2.0"],"locations":[{"path":"/bin/versions/node/v4.2.1/lib/node_modules/npm/package.json","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/lib/node_modules/npm/package.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.15.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m5h6-hr3q-22h5","versionConstraint":"<=2.15.0 (semantic)"},"matcher":"javascript-matcher","searchedBy":{"package":{"name":"npm","version":"2.14.7"},"language":"javascript","namespace":"github:language:javascript"}}],"vulnerability":{"id":"GHSA-m5h6-hr3q-22h5","fix":{"state":"fixed","versions":["2.15.1"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"2.15.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3956","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3956","date":"2026-11-02","epss":0.05456,"percentile":0.92742}],"risk":4.092,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-3956","https://www.npmjs.com/advisories/98","http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability","https://github.com/npm/npm/issues/8380","https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29","https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401","https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/","http://www-01.ibm.com/support/docview.wss?uid=swg21980827"],"severity":"High","namespace":"github:language:javascript","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m5h6-hr3q-22h5","description":"npm Token Leak in npm"},"relatedVulnerabilities":[{"id":"CVE-2016-3956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3956","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3956","date":"2026-11-02","epss":0.05456,"percentile":0.92742}],"urls":["http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability","http://www-01.ibm.com/support/docview.wss?uid=swg21980827","https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29","https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401","https://github.com/npm/npm/issues/8380","https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3956","description":"The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.8.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-9842","versionConstraint":">= 4.0.0, < 4.8.2||>= 6.0.0, < 6.10.2||>= 7.0.0, < 7.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["4.8.2","6.10.2","7.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.8.2"},{"date":"2025-09-04","kind":"first-observed","version":"6.10.2"},{"date":"2025-09-04","kind":"first-observed","version":"7.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-11-02","epss":0.05204,"percentile":0.92485}],"risk":4.067793333333334,"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."},"relatedVulnerabilities":[]},{"artifact":{"id":"36d900d0fa2d5a1d","cpes":["cpe:2.3:a:git:git:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/ubuntu/git@1%3A1.9.1-1ubuntu0.7?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-41953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-41953","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41953","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41953","date":"2026-11-02","epss":0.08038,"percentile":0.94785}],"risk":4.018999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41953"},"relatedVulnerabilities":[{"id":"CVE-2022-41953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41953","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41953","date":"2026-11-02","epss":0.08038,"percentile":0.94785}],"urls":["https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39f","https://github.com/git-for-windows/git/pull/4219","https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c","https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41953","description":"Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources."}]},{"artifact":{"id":"abee80c604ef74c6","cpes":["cpe:2.3:a:git-man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:1.9.1-1ubuntu0.7:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/ubuntu/git-man@1%3A1.9.1-1ubuntu0.7?arch=all&distro=ubuntu-14.04&upstream=git","type":"deb","version":"1:1.9.1-1ubuntu0.7","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:b68a7d7e7e116c392f776fb80f9f549669fac69bdef36adde9a5e8fbb921c110","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"git","version":"1:1.9.1-1ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-41953","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41953","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41953","date":"2026-11-02","epss":0.08038,"percentile":0.94785}],"risk":4.018999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41953"},"relatedVulnerabilities":[{"id":"CVE-2022-41953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41953","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41953","date":"2026-11-02","epss":0.08038,"percentile":0.94785}],"urls":["https://github.com/git-for-windows/git/commit/7360767e8dfc1895a932324079f7d45d7791d39f","https://github.com/git-for-windows/git/pull/4219","https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c","https://www.tcl.tk/man/tcl8.6/TclCmd/exec.html#M23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41953","description":"Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources."}]},{"artifact":{"id":"cfa724231f4daf70","cpes":["cpe:2.3:a:libservlet3.0-java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0-java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0_java:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0-java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*","cpe:2.3:a:libservlet3.0:libservlet3.0_java:7.0.52-1ubuntu0.11:*:*:*:*:*:*:*"],"name":"libservlet3.0-java","purl":"pkg:deb/ubuntu/libservlet3.0-java@7.0.52-1ubuntu0.11?arch=all&distro=ubuntu-14.04&upstream=tomcat7","type":"deb","version":"7.0.52-1ubuntu0.11","language":"","licenses":["sha256:f440bd2f4435ef58ce6700aa5ee7ea707d094b5a8f509bc52b8fa1f1b19303ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet3.0-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet3.0-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet3.0-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet3.0-java.list"}],"upstreams":[{"name":"tomcat7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.0.52-1ubuntu0.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7674","versionConstraint":"< 7.0.52-1ubuntu0.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat7","version":"7.0.52-1ubuntu0.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-7674","fix":{"state":"fixed","versions":["7.0.52-1ubuntu0.13"],"available":[{"date":"2018-01-08","kind":"advisory","version":"7.0.52-1ubuntu0.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-7674","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7674","date":"2026-11-02","epss":0.08037,"percentile":0.94785}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7674"},"relatedVulnerabilities":[{"id":"CVE-2017-7674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7674","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7674","date":"2026-11-02","epss":0.08037,"percentile":0.94785}],"urls":["http://www.debian.org/security/2017/dsa-3974","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/100280","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:3081","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://security.netapp.com/advisory/ntap-20180614-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7674","description":"The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances."}]},{"artifact":{"id":"d654d35a4e09f2c2","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"33bfb2183c5b9cdd","cpes":["cpe:2.3:a:libsasl2-modules:libsasl2-modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-modules","purl":"pkg:deb/ubuntu/libsasl2-modules@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libsasl2-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libsasl2-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"8b7bb767e1732fb3","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-11-02","epss":0.08036,"percentile":0.94783}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2633","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2633","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2633","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2633","fix":{"state":"fixed","versions":["1.6.0_181","6.0.181","1.7.0_171","7.0.171","1.8.0_161","8.0.161","9.0.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_161"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.161"},{"date":"2025-09-04","kind":"first-observed","version":"9.0.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2633","date":"2026-11-02","epss":0.0565,"percentile":0.92967}],"risk":4.0115,"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.securityfocus.com/bid/102557","http://www.securitytracker.com/id/1040203","https://access.redhat.com/errata/RHSA-2018:0095","https://access.redhat.com/errata/RHSA-2018:0099","https://access.redhat.com/errata/RHSA-2018:0100","https://access.redhat.com/errata/RHSA-2018:0115","https://access.redhat.com/errata/RHSA-2018:0349","https://access.redhat.com/errata/RHSA-2018:0351","https://access.redhat.com/errata/RHSA-2018:0352","https://access.redhat.com/errata/RHSA-2018:0458","https://access.redhat.com/errata/RHSA-2018:0521","https://access.redhat.com/errata/RHSA-2018:1463","https://access.redhat.com/errata/RHSA-2018:1812","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/04/msg00003.html","https://security.netapp.com/advisory/ntap-20180117-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03911en_us","https://usn.ubuntu.com/3613-1/","https://usn.ubuntu.com/3614-1/","https://www.debian.org/security/2018/dsa-4144","https://www.debian.org/security/2018/dsa-4166"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2633","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19926","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19926","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19926","date":"2026-11-02","epss":0.08023,"percentile":0.94774}],"risk":4.0115,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19926"},"relatedVulnerabilities":[{"id":"CVE-2019-19926","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19926","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19926","date":"2026-11-02","epss":0.08023,"percentile":0.94774}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","https://access.redhat.com/errata/RHSA-2020:0514","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089","https://security.netapp.com/advisory/ntap-20200114-0003/","https://usn.ubuntu.com/4298-1/","https://usn.ubuntu.com/4298-2/","https://www.debian.org/security/2020/dsa-4638","https://www.oracle.com/security-alerts/cpuapr2020.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19926","description":"multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880."}]},{"artifact":{"id":"91e22e3289c39d88","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-5:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/ubuntu/bzip2@1.0.6-5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.list"},{"path":"/var/lib/dpkg/info/bzip2.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/bzip2.preinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-11-02","epss":0.07977,"percentile":0.94753}],"risk":3.9884999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-11-02","epss":0.07977,"percentile":0.94753}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"f59d1e0c17b85413","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/ubuntu/libbz2-1.0@1.0.6-5?arch=amd64&distro=ubuntu-14.04&upstream=bzip2","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-11-02","epss":0.07977,"percentile":0.94753}],"risk":3.9884999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-11-02","epss":0.07977,"percentile":0.94753}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 2.7.6-8ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.4"],"available":[{"date":"2017-11-28","kind":"advisory","version":"2.7.6-8ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 2.7.6-8ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.4"],"available":[{"date":"2017-11-28","kind":"advisory","version":"2.7.6-8ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 2.7.6-8ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.4"],"available":[{"date":"2017-11-28","kind":"advisory","version":"2.7.6-8ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.6-8ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 2.7.6-8ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["2.7.6-8ubuntu0.4"],"available":[{"date":"2017-11-28","kind":"advisory","version":"2.7.6-8ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-11-02","epss":0.07944,"percentile":0.94737}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21340","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21340","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_321"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-21340","versionConstraint":"< 1.7.0_331||>= 1.8, < 1.8.0_321||>= 1.9, < 7.0.331||>= 12, < 17.0.2||>= 8, < 8.0.321||>= 9, < 11.0.14 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-21340","fix":{"state":"fixed","versions":["1.7.0_331","7.0.331","1.8.0_321","8.0.321","11.0.14","17.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_331"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.331"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.14"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-21340","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-21340","date":"2026-11-02","epss":0.07748,"percentile":0.94634}],"risk":3.9321100000000007,"urls":["https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20220121-0007/","https://www.debian.org/security/2022/dsa-5057","https://www.debian.org/security/2022/dsa-5058","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21340","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6b3100cf51d779d2","cpes":["cpe:2.3:a:xterm:xterm:297-1ubuntu1:*:*:*:*:*:*:*"],"name":"xterm","purl":"pkg:deb/ubuntu/xterm@297-1ubuntu1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"297-1ubuntu1","language":"","licenses":["sha256:7a27cdfde4ee4b58ba8760648994780c4e03e73f691528503c233e9f08a8b814"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xterm/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/xterm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.list"},{"path":"/var/lib/dpkg/info/xterm.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.postinst"},{"path":"/var/lib/dpkg/info/xterm.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.postrm"},{"path":"/var/lib/dpkg/info/xterm.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/xterm.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-27135","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"xterm","version":"297-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-27135","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-27135","date":"2026-11-02","epss":0.07844,"percentile":0.94683}],"risk":3.9219999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-27135"},"relatedVulnerabilities":[{"id":"CVE-2021-27135","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-27135","date":"2026-11-02","epss":0.07844,"percentile":0.94683}],"urls":["http://seclists.org/fulldisclosure/2021/May/52","http://www.openwall.com/lists/oss-security/2021/02/10/7","https://access.redhat.com/security/cve/CVE-2021-27135","https://bugzilla.redhat.com/show_bug.cgi?id=1927559","https://bugzilla.suse.com/show_bug.cgi?id=1182091","https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c","https://invisible-island.net/xterm/xterm.log.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/","https://news.ycombinator.com/item?id=26524650","https://security.gentoo.org/glsa/202208-22","https://www.openwall.com/lists/oss-security/2021/02/09/7","https://www.openwall.com/lists/oss-security/2021/02/09/9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27135","description":"xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence."}]},{"artifact":{"id":"69ab73fa836c83c0","cpes":["cpe:2.3:a:ant:ant:1.9.3-2build1:*:*:*:*:*:*:*"],"name":"ant","purl":"pkg:deb/ubuntu/ant@1.9.3-2build1?arch=all&distro=ubuntu-14.04","type":"deb","version":"1.9.3-2build1","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ant/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/ant/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ant.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/ant.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ant.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/ant.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-11979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ant","version":"1.9.3-2build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-11979","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-11979","cwe":"CWE-379","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2020-11979","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11979","date":"2026-11-02","epss":0.07757,"percentile":0.94638}],"risk":3.8785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-11979"},"relatedVulnerabilities":[{"id":"CVE-2020-11979","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11979","cwe":"CWE-379","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2020-11979","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11979","date":"2026-11-02","epss":0.07757,"percentile":0.94638}],"urls":["https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm","https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/","https://security.gentoo.org/glsa/202011-18","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11979","description":"As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process."}]},{"artifact":{"id":"abd965fbf4eb9d20","cpes":["cpe:2.3:a:ant-optional:ant-optional:1.9.3-2build1:*:*:*:*:*:*:*","cpe:2.3:a:ant-optional:ant_optional:1.9.3-2build1:*:*:*:*:*:*:*","cpe:2.3:a:ant_optional:ant-optional:1.9.3-2build1:*:*:*:*:*:*:*","cpe:2.3:a:ant_optional:ant_optional:1.9.3-2build1:*:*:*:*:*:*:*","cpe:2.3:a:ant:ant-optional:1.9.3-2build1:*:*:*:*:*:*:*","cpe:2.3:a:ant:ant_optional:1.9.3-2build1:*:*:*:*:*:*:*"],"name":"ant-optional","purl":"pkg:deb/ubuntu/ant-optional@1.9.3-2build1?arch=all&distro=ubuntu-14.04&upstream=ant","type":"deb","version":"1.9.3-2build1","language":"","licenses":["Apache-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ant-optional/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/ant-optional/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ant-optional.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/ant-optional.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ant-optional.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/ant-optional.list"}],"upstreams":[{"name":"ant"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ant","version":"1.9.3-2build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-11979","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-11979","cwe":"CWE-379","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2020-11979","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11979","date":"2026-11-02","epss":0.07757,"percentile":0.94638}],"risk":3.8785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-11979"},"relatedVulnerabilities":[{"id":"CVE-2020-11979","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11979","cwe":"CWE-379","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2020-11979","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11979","date":"2026-11-02","epss":0.07757,"percentile":0.94638}],"urls":["https://github.com/gradle/gradle/security/advisories/GHSA-j45w-qrgf-25vm","https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AALW42FWNQ35F7KB3JVRC6NBVV7AAYYI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYBRN5C2RW7JRY75IB7Q7ZVKZCHWAQWS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3NRQQ7ECII4ZNGW7GBC225LVYMPQEKB/","https://security.gentoo.org/glsa/202011-18","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11979","description":"As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process."}]},{"artifact":{"id":"cf9752f2b0369c8e","cpes":["cpe:2.3:a:libpython2.7-minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_minimal:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-minimal","purl":"pkg:deb/ubuntu/libpython2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"26b2b1e38c58b07a","cpes":["cpe:2.3:a:libpython2.7-stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7-stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7_stdlib:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7-stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython2.7:libpython2.7_stdlib:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"libpython2.7-stdlib","purl":"pkg:deb/ubuntu/libpython2.7-stdlib@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/libpython2.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/libpython2.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"ef86459cc49f3098","cpes":["cpe:2.3:a:python2.7:python2.7:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.list"},{"path":"/var/lib/dpkg/info/python2.7.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postinst"},{"path":"/var/lib/dpkg/info/python2.7.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.postrm"},{"path":"/var/lib/dpkg/info/python2.7.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"0661ea8f61f5ba35","cpes":["cpe:2.3:a:python2.7-minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7-minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7_minimal:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7-minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:python2.7:python2.7_minimal:2.7.6-8ubuntu0.3:*:*:*:*:*:*:*"],"name":"python2.7-minimal","purl":"pkg:deb/ubuntu/python2.7-minimal@2.7.6-8ubuntu0.3?arch=amd64&distro=ubuntu-14.04&upstream=python2.7","type":"deb","version":"2.7.6-8ubuntu0.3","language":"","licenses":["sha256:65ea9ce092a7099f20afd6970dd5a682b0338f8edcde436ea60771fb826abce4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python2.7-minimal/copyright","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/usr/share/doc/python2.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.md5sums","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python2.7-minimal.list","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.list"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.postrm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python2.7-minimal.preinst","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python2.7-minimal.prerm","layerID":"sha256:d7e2bdea25b6ec5e8f2865c3c7960c64a6c615db89935b24706c3b9012e712ae","accessPath":"/var/lib/dpkg/info/python2.7-minimal.prerm"}],"upstreams":[{"name":"python2.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python2.7","version":"2.7.6-8ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"risk":3.8365000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-11-02","epss":0.07673,"percentile":0.9459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"6374a09a7d4d758d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"a3cb1cf662d7cf5a","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"46c622ce6f369526","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"46057312fc395447","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.5:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.5?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.5","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-11-02","epss":0.12706,"percentile":0.96265}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-6056","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-6056","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-6056","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6056","date":"2026-11-02","epss":0.07579,"percentile":0.94535}],"risk":3.7895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-6056"},"relatedVulnerabilities":[{"id":"CVE-2017-6056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6056","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6056","date":"2026-11-02","epss":0.07579,"percentile":0.94535}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0517.html","http://rhn.redhat.com/errata/RHSA-2017-0826.html","http://rhn.redhat.com/errata/RHSA-2017-0827.html","http://rhn.redhat.com/errata/RHSA-2017-0828.html","http://rhn.redhat.com/errata/RHSA-2017-0829.html","http://www.debian.org/security/2017/dsa-3787","http://www.debian.org/security/2017/dsa-3788","http://www.securityfocus.com/bid/96293","http://www.securitytracker.com/id/1037860","https://bugs.debian.org/851304","https://bz.apache.org/bugzilla/show_bug.cgi?id=60578","https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://lists.debian.org/debian-security-announce/2017/msg00038.html","https://lists.debian.org/debian-security-announce/2017/msg00039.html","https://security.netapp.com/advisory/ntap-20180731-0002/","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6056","description":"It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35565","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35565","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35565","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35565","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35565","date":"2026-11-02","epss":0.07395,"percentile":0.94429}],"risk":3.7714500000000006,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-5000","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35565","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2798","fix":{"state":"fixed","versions":["1.6.0_191","6.0.191","1.7.0_181","7.0.181","1.8.0_171","8.0.171","10.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_191"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.191"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2798","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.7704299999999997,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103841","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2798","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5174","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5174","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2016-02-24","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5174","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5174","date":"2026-11-02","epss":0.12555,"percentile":0.96235}],"risk":3.7664999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5174"},"relatedVulnerabilities":[{"id":"CVE-2015-5174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5174","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5174","date":"2026-11-02","epss":0.12555,"percentile":0.96235}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","http://marc.info/?l=bugtraq&m=145974991225029&w=2","http://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html","http://rhn.redhat.com/errata/RHSA-2016-1435.html","http://rhn.redhat.com/errata/RHSA-2016-2045.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://seclists.org/bugtraq/2016/Feb/149","http://svn.apache.org/viewvc?view=revision&revision=1696281","http://svn.apache.org/viewvc?view=revision&revision=1696284","http://svn.apache.org/viewvc?view=revision&revision=1700897","http://svn.apache.org/viewvc?view=revision&revision=1700898","http://svn.apache.org/viewvc?view=revision&revision=1700900","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.debian.org/security/2016/dsa-3609","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.securityfocus.com/bid/83329","http://www.securitytracker.com/id/1035070","http://www.ubuntu.com/usn/USN-3024-1","https://access.redhat.com/errata/RHSA-2016:1432","https://access.redhat.com/errata/RHSA-2016:1433","https://access.redhat.com/errata/RHSA-2016:1434","https://bto.bluecoat.com/security-advisory/sa118","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r0b24f2c7507f702348e2c2d64e8a5de72bad6173658e8d8e45322ac2%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rd4863c79bf729aabb95571fd845a9ea4ee3ae3fcee48f35aba007350%40%3Cusers.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180531-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5174","description":"Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-20506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-11-02","epss":0.07504,"percentile":0.9449}],"risk":3.752,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20506"},"relatedVulnerabilities":[{"id":"CVE-2018-20506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-11-02","epss":0.07504,"percentile":0.9449}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://seclists.org/fulldisclosure/2019/Jan/62","http://seclists.org/fulldisclosure/2019/Jan/64","http://seclists.org/fulldisclosure/2019/Jan/66","http://seclists.org/fulldisclosure/2019/Jan/67","http://seclists.org/fulldisclosure/2019/Jan/68","http://seclists.org/fulldisclosure/2019/Jan/69","http://www.securityfocus.com/bid/106698","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://seclists.org/bugtraq/2019/Jan/28","https://seclists.org/bugtraq/2019/Jan/29","https://seclists.org/bugtraq/2019/Jan/31","https://seclists.org/bugtraq/2019/Jan/32","https://seclists.org/bugtraq/2019/Jan/33","https://seclists.org/bugtraq/2019/Jan/39","https://security.netapp.com/advisory/ntap-20190502-0004/","https://sqlite.org/src/info/940f2adc8541a838","https://support.apple.com/kb/HT209443","https://support.apple.com/kb/HT209446","https://support.apple.com/kb/HT209447","https://support.apple.com/kb/HT209448","https://support.apple.com/kb/HT209450","https://support.apple.com/kb/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20506","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2795","fix":{"state":"fixed","versions":["1.6.0_191","6.0.191","1.7.0_181","7.0.181","1.8.0_171","8.0.171","10.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_191"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.191"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2795","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.7519475000000004,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103847","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2795","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_171"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 1.6.0_191||>= 1.7, < 1.7.0_181||>= 1.8, < 1.8.0_171||>= 6, < 6.0.191||>= 7, < 7.0.181||>= 8, < 8.0.171||>= 9, < 10.0.1 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2797","fix":{"state":"fixed","versions":["1.6.0_191","6.0.191","1.7.0_181","7.0.181","1.8.0_171","8.0.171","10.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_191"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.191"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"10.0.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2797","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.7519475000000004,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103846","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2797","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-3956","versionConstraint":"= 0.10.0||= 0.10.1||= 0.10.10||= 0.10.11||= 0.10.12||= 0.10.13||= 0.10.14||= 0.10.15||= 0.10.16||= 0.10.16-isaacs-manual||= 0.10.17||= 0.10.18||= 0.10.19||= 0.10.2||= 0.10.20||= 0.10.21||= 0.10.22||= 0.10.23||= 0.10.24||= 0.10.25||= 0.10.26||= 0.10.27||= 0.10.28||= 0.10.29||= 0.10.3||= 0.10.30||= 0.10.31||= 0.10.32||= 0.10.33||= 0.10.34||= 0.10.35||= 0.10.36||= 0.10.37||= 0.10.38||= 0.10.39||= 0.10.4||= 0.10.40||= 0.10.41||= 0.10.5||= 0.10.6||= 0.10.7||= 0.10.8||= 0.10.9||= 0.12.0||= 0.12.1||= 0.12.2||= 0.12.3||= 0.12.4||= 0.12.5||= 0.12.6||= 0.12.7||= 0.12.8||= 0.12.9||= 4.0.0||= 4.1.0||= 4.1.1||= 4.1.2||= 4.2.0||= 4.2.1||= 4.2.2||= 4.2.3||= 4.2.4||= 4.2.5||= 4.2.6||= 4.3.0||= 4.3.1||= 4.3.1-rc.1||= 4.3.1-rc.2||= 4.3.2||= 4.4.0||= 4.4.0-rc.1||= 4.4.0-rc.2||= 4.4.0-rc.3||= 4.4.0-rc.4||= 4.4.1||= 5.0.0||= 5.1.0||= 5.1.1||= 5.2.0||= 5.3.0||= 5.4.0||= 5.4.1||= 5.5.0||= 5.6.0||= 5.7.0||= 5.7.1||= 5.8.0||= 5.8.1-rc.1||= 5.9.0||= 5.9.1 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-3956","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3956","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3956","date":"2026-11-02","epss":0.05456,"percentile":0.92742}],"risk":3.7510000000000003,"urls":["http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability","http://www-01.ibm.com/support/docview.wss?uid=swg21980827","https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29","https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401","https://github.com/npm/npm/issues/8380","https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3956","description":"The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers."},"relatedVulnerabilities":[]},{"artifact":{"id":"c0fc697d6f7b9986","cpes":["cpe:2.3:a:libtiff5:libtiff5:4.0.3-7ubuntu0.7:*:*:*:*:*:*:*"],"name":"libtiff5","purl":"pkg:deb/ubuntu/libtiff5@4.0.3-7ubuntu0.7?arch=amd64&distro=ubuntu-14.04&upstream=tiff","type":"deb","version":"4.0.3-7ubuntu0.7","language":"","licenses":["sha256:af0acd0969682339cb3d81dd24ec0b6c91d6d9c671619e390c6381cd6a3faa5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff5/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libtiff5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libtiff5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.3-7ubuntu0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9936","versionConstraint":"< 4.0.3-7ubuntu0.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tiff","version":"4.0.3-7ubuntu0.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9936","fix":{"state":"fixed","versions":["4.0.3-7ubuntu0.8"],"available":[{"date":"2018-03-20","kind":"advisory","version":"4.0.3-7ubuntu0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9936","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9936","date":"2026-11-02","epss":0.07482,"percentile":0.94477}],"risk":3.7409999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9936"},"relatedVulnerabilities":[{"id":"CVE-2017-9936","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9936","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9936","date":"2026-11-02","epss":0.07482,"percentile":0.94477}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2706","http://www.debian.org/security/2017/dsa-3903","http://www.securityfocus.com/bid/99300","https://usn.ubuntu.com/3602-1/","https://www.exploit-db.com/exploits/42300/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9936","description":"In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-11499","versionConstraint":"= 4.0.0||= 4.1.0||= 4.1.1||= 4.1.2||= 4.2.0||= 4.2.1||= 4.2.2||= 4.2.3||= 4.2.4||= 4.2.5||= 4.2.6||= 4.3.0||= 4.3.1||= 4.3.2||= 4.4.0||= 4.4.1||= 4.4.2||= 4.4.3||= 4.4.4||= 4.4.5||= 4.4.6||= 4.4.7||= 4.5.0||= 4.6.0||= 4.6.1||= 4.6.2||= 4.7.0||= 4.7.1||= 4.7.2||= 4.7.3||= 4.8.0||= 4.8.1||= 4.8.2||= 4.8.3||= 5.0.0||= 5.1.0||= 5.1.1||= 5.10.0||= 5.10.1||= 5.11.0||= 5.11.1||= 5.12.0||= 5.2.0||= 5.3.0||= 5.4.0||= 5.4.1||= 5.5.0||= 5.6.0||= 5.7.0||= 5.7.1||= 5.8.0||= 5.9.0||= 5.9.1||= 6.0.0||= 6.1.0||= 6.10.0||= 6.10.1||= 6.10.2||= 6.10.3||= 6.11.0||= 6.11.1||= 6.2.0||= 6.2.1||= 6.2.2||= 6.3.0||= 6.3.1||= 6.4.0||= 6.5.0||= 6.6.0||= 6.7.0||= 6.8.0||= 6.8.1||= 6.9.0||= 6.9.1||= 6.9.2||= 6.9.3||= 6.9.4||= 6.9.5||= 7.0.0||= 7.1.0||= 7.10.0||= 7.10.1||= 7.2.0||= 7.2.1||= 7.3.0||= 7.4.0||= 7.5.0||= 7.6.0||= 7.7.0||= 7.7.1||= 7.7.2||= 7.7.3||= 7.7.4||= 7.8.0||= 7.9.0||= 8.0.0||= 8.1.0||= 8.1.1||= 8.1.2||= 8.1.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-11499","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11499","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11499","date":"2026-11-02","epss":0.05434,"percentile":0.92718}],"risk":3.7358749999999996,"urls":["http://www.securityfocus.com/bid/99959","https://access.redhat.com/errata/RHSA-2017:2908","https://access.redhat.com/errata/RHSA-2017:3002","https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11499","description":"Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.8.2"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-9840","versionConstraint":">= 4.0.0, < 4.8.2||>= 6.0.0, < 6.10.2||>= 7.0.0, < 7.6.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-9840","fix":{"state":"fixed","versions":["4.8.2","6.10.2","7.6.0"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.8.2"},{"date":"2025-09-04","kind":"first-observed","version":"6.10.2"},{"date":"2025-09-04","kind":"first-observed","version":"7.6.0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9840","date":"2026-11-02","epss":0.04875,"percentile":0.92056}],"risk":3.729375,"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402345","https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9840","description":"inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."},"relatedVulnerabilities":[]},{"artifact":{"id":"b9d4c44e7b402084","cpes":["cpe:2.3:a:libudev1:libudev1:204-5ubuntu20.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@204-5ubuntu20.24?arch=amd64&distro=ubuntu-14.04&upstream=systemd","type":"deb","version":"204-5ubuntu20.24","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"204-5ubuntu20.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 204-5ubuntu20.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"systemd","version":"204-5ubuntu20.24"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["204-5ubuntu20.26"],"available":[{"date":"2018-02-05","kind":"advisory","version":"204-5ubuntu20.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-11-02","epss":0.07441,"percentile":0.94455}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-11-02","epss":0.07441,"percentile":0.94455}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"78126ab8c220ccde","cpes":["cpe:2.3:a:udev:udev:204-5ubuntu20.24:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/ubuntu/udev@204-5ubuntu20.24?arch=amd64&distro=ubuntu-14.04&upstream=systemd","type":"deb","version":"204-5ubuntu20.24","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/udev/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"204-5ubuntu20.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 204-5ubuntu20.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"systemd","version":"204-5ubuntu20.24"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["204-5ubuntu20.26"],"available":[{"date":"2018-02-05","kind":"advisory","version":"204-5ubuntu20.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-11-02","epss":0.07441,"percentile":0.94455}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-11-02","epss":0.07441,"percentile":0.94455}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25235","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-25235","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-11-02","epss":0.04955,"percentile":0.92177}],"risk":3.71625,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-25235"},"relatedVulnerabilities":[{"id":"CVE-2022-25235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-11-02","epss":0.04955,"percentile":0.92177}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/562","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-484086.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","description":"xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context."}]},{"artifact":{"id":"dba47ceadd4198eb","cpes":["cpe:2.3:a:libbatik-java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik-java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik_java:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik-java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*","cpe:2.3:a:libbatik:libbatik_java:1.7.ubuntu-8ubuntu2.14.04.2:*:*:*:*:*:*:*"],"name":"libbatik-java","purl":"pkg:deb/ubuntu/libbatik-java@1.7.ubuntu-8ubuntu2.14.04.2?arch=all&distro=ubuntu-14.04&upstream=batik","type":"deb","version":"1.7.ubuntu-8ubuntu2.14.04.2","language":"","licenses":["sha256:5f184f3d7c36b1936ca4b863891979662da999f1d694d0ac22b078e77173af51"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbatik-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libbatik-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbatik-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libbatik-java.list"}],"upstreams":[{"name":"batik"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-40146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"batik","version":"1.7.ubuntu-8ubuntu2.14.04.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-40146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-40146","cwe":"CWE-918","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-40146","cwe":"CWE-918","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40146","date":"2026-11-02","epss":0.07431,"percentile":0.94449}],"risk":3.7155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40146"},"relatedVulnerabilities":[{"id":"CVE-2022-40146","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40146","cwe":"CWE-918","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-40146","cwe":"CWE-918","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-40146","date":"2026-11-02","epss":0.07431,"percentile":0.94449}],"urls":["https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx","https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html","https://security.gentoo.org/glsa/202401-11","https://lists.debian.org/debian-lts-announce/2025/07/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40146","description":"Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14."}]},{"artifact":{"id":"2e742213a192b3e3","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.10:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.10?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7426","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-7426","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"],"available":[{"date":"2017-07-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7426","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7426","date":"2026-11-02","epss":0.12367,"percentile":0.96202}],"risk":3.7101,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-7426"},"relatedVulnerabilities":[{"id":"CVE-2016-7426","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7426","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7426","date":"2026-11-02","epss":0.12367,"percentile":0.96202}],"urls":["http://nwtime.org/ntp428p9_release/","http://rhn.redhat.com/errata/RHSA-2017-0252.html","http://support.ntp.org/bin/view/Main/NtpBug3071","http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities","http://www.securityfocus.com/bid/94451","http://www.securitytracker.com/id/1037354","https://bto.bluecoat.com/security-advisory/sa139","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc","https://usn.ubuntu.com/3707-2/","https://www.kb.cert.org/vuls/id/633847"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7426","description":"NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-11-02","epss":0.0741,"percentile":0.94439}],"risk":3.705,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23841"},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-11-02","epss":0.0741,"percentile":0.94439}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-11-02","epss":0.0741,"percentile":0.94439}],"risk":3.705,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23841"},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-11-02","epss":0.0741,"percentile":0.94439}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_241"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2604","versionConstraint":"< 1.7.0_251||>= 1.8, < 1.8.0_241||>= 12, < 13.0.2||>= 7, < 7.0.251||>= 8, < 8.0.241||>= 9, < 11.0.6 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_241"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2604","versionConstraint":"< 1.7.0_251||>= 1.8, < 1.8.0_241||>= 12, < 13.0.2||>= 7, < 7.0.251||>= 8, < 8.0.241||>= 9, < 11.0.6 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_241"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-2604","versionConstraint":"< 1.7.0_251||>= 1.8, < 1.8.0_241||>= 12, < 13.0.2||>= 7, < 7.0.251||>= 8, < 8.0.241||>= 9, < 11.0.6 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-2604","fix":{"state":"fixed","versions":["1.7.0_251","7.0.251","1.8.0_241","8.0.241","11.0.6","13.0.2"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_251"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_241"},{"date":"2025-09-04","kind":"first-observed","version":"13.0.2"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.251"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.241"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-2604","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-2604","date":"2026-11-02","epss":0.04881,"percentile":0.92063}],"risk":3.701425,"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html","https://access.redhat.com/errata/RHSA-2020:0122","https://access.redhat.com/errata/RHSA-2020:0128","https://access.redhat.com/errata/RHSA-2020:0196","https://access.redhat.com/errata/RHSA-2020:0202","https://access.redhat.com/errata/RHSA-2020:0231","https://access.redhat.com/errata/RHSA-2020:0232","https://access.redhat.com/errata/RHSA-2020:0465","https://access.redhat.com/errata/RHSA-2020:0467","https://access.redhat.com/errata/RHSA-2020:0468","https://access.redhat.com/errata/RHSA-2020:0469","https://access.redhat.com/errata/RHSA-2020:0470","https://access.redhat.com/errata/RHSA-2020:0541","https://access.redhat.com/errata/RHSA-2020:0632","https://kc.mcafee.com/corporate/index?page=content&id=SB10315","https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html","https://seclists.org/bugtraq/2020/Feb/22","https://security.gentoo.org/glsa/202101-19","https://security.netapp.com/advisory/ntap-20200122-0003/","https://usn.ubuntu.com/4257-1/","https://www.debian.org/security/2020/dsa-4621","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-2604","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2795","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2795","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2795"},"relatedVulnerabilities":[{"id":"CVE-2018-2795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2795","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103847","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2795","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2797","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2797","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2797"},"relatedVulnerabilities":[{"id":"CVE-2018-2797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2797","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103846","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2797","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2798","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2798","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2798"},"relatedVulnerabilities":[{"id":"CVE-2018-2798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2798","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103841","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2798","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2795","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2795","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2795"},"relatedVulnerabilities":[{"id":"CVE-2018-2795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2795","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103847","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2795","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2797","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2797","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2797"},"relatedVulnerabilities":[{"id":"CVE-2018-2797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2797","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103846","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2797","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 7u181-2.6.14-0ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-2798","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.1"],"available":[{"date":"2018-06-21","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2798","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-2798"},"relatedVulnerabilities":[{"id":"CVE-2018-2798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2798","date":"2026-11-02","epss":0.07393,"percentile":0.94428}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103841","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2798","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2015-8027","versionConstraint":"= 0.12.0||= 0.12.1||= 0.12.2||= 0.12.3||= 0.12.4||= 0.12.5||= 0.12.6||= 0.12.7||= 0.12.8||= 4.2.0||= 4.2.1||= 4.2.2||= 5.0.0||= 5.1.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2015-8027","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8027","cwe":"CWE-17","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8027","date":"2026-11-02","epss":0.05356,"percentile":0.9264}],"risk":3.6822500000000002,"urls":["http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html","http://www-01.ibm.com/support/docview.wss?uid=swg1IV79524","http://www-01.ibm.com/support/docview.wss?uid=swg21972419","http://www.securityfocus.com/bid/78207","https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/","https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/","https://security.gentoo.org/glsa/201612-43"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8027","description":"Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request."},"relatedVulnerabilities":[]},{"artifact":{"id":"6ed0c53c6bd4f6d4","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"3734fca4a49a65d7","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:40baf1433fdb0f8d06bad88904e89b306eac310b33f57a9c23aa82a08a6221f4","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"5c9a2d88992b5fc9","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.12:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.12?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.12","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.12"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-11-02","epss":0.07337,"percentile":0.94394}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-11-02","epss":0.0731,"percentile":0.94377}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.27"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"< 1.0.1f-1ubuntu2.27 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.27"],"available":[{"date":"2018-12-06","kind":"advisory","version":"1.0.1f-1ubuntu2.27"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-11-02","epss":0.12154,"percentile":0.96157}],"risk":3.6461999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-11-02","epss":0.12154,"percentile":0.96157}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.27"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"< 1.0.1f-1ubuntu2.27 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.27"],"available":[{"date":"2018-12-06","kind":"advisory","version":"1.0.1f-1ubuntu2.27"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-11-02","epss":0.12154,"percentile":0.96157}],"risk":3.6461999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-11-02","epss":0.12154,"percentile":0.96157}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"489672dba47db8ac","cpes":["cpe:2.3:a:libdom4j-java:libdom4j-java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libdom4j-java:libdom4j_java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libdom4j_java:libdom4j-java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libdom4j_java:libdom4j_java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libdom4j:libdom4j-java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libdom4j:libdom4j_java:1.6.1\\+dfsg.3-2ubuntu1:*:*:*:*:*:*:*"],"name":"libdom4j-java","purl":"pkg:deb/ubuntu/libdom4j-java@1.6.1%2Bdfsg.3-2ubuntu1?arch=all&distro=ubuntu-14.04&upstream=dom4j","type":"deb","version":"1.6.1+dfsg.3-2ubuntu1","language":"","licenses":["DOM4J"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdom4j-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libdom4j-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdom4j-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libdom4j-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdom4j-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libdom4j-java.list"}],"upstreams":[{"name":"dom4j"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10683","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"dom4j","version":"1.6.1+dfsg.3-2ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-10683","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10683","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10683","date":"2026-11-02","epss":0.07269,"percentile":0.94353}],"risk":3.6345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10683"},"relatedVulnerabilities":[{"id":"CVE-2020-10683","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10683","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10683","date":"2026-11-02","epss":0.07269,"percentile":0.94353}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html","https://bugzilla.redhat.com/show_bug.cgi?id=1694235","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658","https://github.com/dom4j/dom4j/commits/version-2.0.3","https://github.com/dom4j/dom4j/issues/87","https://github.com/dom4j/dom4j/releases/tag/version-2.1.3","https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E","https://security.netapp.com/advisory/ntap-20200518-0002/","https://usn.ubuntu.com/4575-1/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10683","description":"dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."}]},{"artifact":{"id":"b2c7bf4dda07faef","cpes":["cpe:2.3:a:openjdk-7-jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre","purl":"pkg:deb/ubuntu/openjdk-7-jre@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 7u181-2.6.14-0ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-3149","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.3"],"available":[{"date":"2018-11-16","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.3"}]},"cvss":[],"epss":[{"cve":"CVE-2018-3149","date":"2026-11-02","epss":0.07156,"percentile":0.94281}],"risk":3.578,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-3149"},"relatedVulnerabilities":[{"id":"CVE-2018-3149","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3149","date":"2026-11-02","epss":0.07156,"percentile":0.94281}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105608","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3521","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://usn.ubuntu.com/3824-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3149","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."}]},{"artifact":{"id":"ba0222ea7d208c48","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u151-2.6.11-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/ubuntu/openjdk-7-jre-headless@7u151-2.6.11-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=openjdk-7","type":"deb","version":"7u151-2.6.11-0ubuntu1.14.04.1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-0ubuntu0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 7u181-2.6.14-0ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openjdk-7","version":"7u151-2.6.11-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-3149","fix":{"state":"fixed","versions":["7u181-2.6.14-0ubuntu0.3"],"available":[{"date":"2018-11-16","kind":"advisory","version":"7u181-2.6.14-0ubuntu0.3"}]},"cvss":[],"epss":[{"cve":"CVE-2018-3149","date":"2026-11-02","epss":0.07156,"percentile":0.94281}],"risk":3.578,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-3149"},"relatedVulnerabilities":[{"id":"CVE-2018-3149","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3149","date":"2026-11-02","epss":0.07156,"percentile":0.94281}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105608","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3521","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://usn.ubuntu.com/3824-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3149","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35561","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35561","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35561","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35561","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13","17.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35561","date":"2026-11-02","epss":0.06946,"percentile":0.94117}],"risk":3.54246,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://www.debian.org/security/2021/dsa-5000","https://www.debian.org/security/2021/dsa-5012","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35561","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0d1fdf07a9645b16","cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"name":"node","purl":"pkg:generic/node@4.2.1","type":"binary","version":"4.2.1","language":"","licenses":[],"locations":[{"path":"/bin/versions/node/v4.2.1/bin/node","layerID":"sha256:18ab436b0618e7bb276eab690e6d8ff7bc57d7fa9a95636c8037a3a4f5c0e0a2","accessPath":"/bin/versions/node/v4.2.1/bin/node","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.4.6"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"vulnerabilityID":"CVE-2016-1669","versionConstraint":">= 4.2.0, < 4.4.6 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*"],"package":{"name":"node","version":"4.2.1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-1669","fix":{"state":"fixed","versions":["4.4.6"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"4.4.6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1669","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1669","date":"2026-11-02","epss":0.04262,"percentile":0.91069}],"risk":3.5268050000000004,"urls":["http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00043.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00063.html","http://rhn.redhat.com/errata/RHSA-2016-1080.html","http://rhn.redhat.com/errata/RHSA-2017-0002.html","http://www.debian.org/security/2016/dsa-3590","http://www.securityfocus.com/bid/90584","http://www.securitytracker.com/id/1035872","http://www.ubuntu.com/usn/USN-2960-1","https://access.redhat.com/errata/RHSA-2017:0879","https://access.redhat.com/errata/RHSA-2017:0880","https://access.redhat.com/errata/RHSA-2017:0881","https://access.redhat.com/errata/RHSA-2017:0882","https://access.redhat.com/errata/RHSA-2018:0336","https://codereview.chromium.org/1945313002","https://crbug.com/606115","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CITS5GIUTNWVSUXMSORIAJJLQBEGL2CK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPTKXI62OPCJCJGCSFMST4HIBQ27J72W/","https://security.gentoo.org/glsa/201605-02"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1669","description":"The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2603","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2603","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_161"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-2603","versionConstraint":"< 1.6.0_181||>= 1.7, < 1.7.0_171||>= 1.8, < 1.8.0_161||>= 6, < 6.0.181||>= 7, < 7.0.171||>= 8, < 8.0.161||>= 9, < 9.0.4 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-2603","fix":{"state":"fixed","versions":["1.6.0_181","6.0.181","1.7.0_171","7.0.171","1.8.0_161","8.0.161","9.0.4"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_181"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_171"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_161"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.181"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.171"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.161"},{"date":"2025-09-04","kind":"first-observed","version":"9.0.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2603","date":"2026-11-02","epss":0.06905,"percentile":0.94088}],"risk":3.5042875,"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.securityfocus.com/bid/102625","http://www.securitytracker.com/id/1040203","https://access.redhat.com/errata/RHSA-2018:0095","https://access.redhat.com/errata/RHSA-2018:0099","https://access.redhat.com/errata/RHSA-2018:0100","https://access.redhat.com/errata/RHSA-2018:0115","https://access.redhat.com/errata/RHSA-2018:0349","https://access.redhat.com/errata/RHSA-2018:0351","https://access.redhat.com/errata/RHSA-2018:0352","https://access.redhat.com/errata/RHSA-2018:0458","https://access.redhat.com/errata/RHSA-2018:0521","https://access.redhat.com/errata/RHSA-2018:1463","https://access.redhat.com/errata/RHSA-2018:1812","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/04/msg00003.html","https://security.netapp.com/advisory/ntap-20180117-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03911en_us","https://usn.ubuntu.com/3613-1/","https://usn.ubuntu.com/3614-1/","https://www.debian.org/security/2018/dsa-4144","https://www.debian.org/security/2018/dsa-4166"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2603","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3214","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3214","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_191"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-3214","versionConstraint":"< 1.6.0_211||>= 1.7, < 1.7.0_201||>= 1.8, < 1.8.0_191||>= 6, < 6.0.211||>= 7, < 7.0.201||>= 8, < 8.0.191 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-3214","fix":{"state":"fixed","versions":["1.6.0_211","6.0.211","1.7.0_201","7.0.201","1.8.0_191","8.0.191"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.6.0_211"},{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_201"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_191"},{"date":"2025-09-04","kind":"first-observed","version":"6.0.211"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.201"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.191"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3214","date":"2026-11-02","epss":0.06868,"percentile":0.94055}],"risk":3.4855100000000006,"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105615","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3214","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"9ec0faaff3afcc6c","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-11-02","epss":0.11597,"percentile":0.96041}],"risk":3.4791000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-11-02","epss":0.11597,"percentile":0.96041}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"d375f5022425874d","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.22:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.22?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.22","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.22"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-11-02","epss":0.11597,"percentile":0.96041}],"risk":3.4791000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-11-02","epss":0.11597,"percentile":0.96041}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35586","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35586","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35586","versionConstraint":"< 1.7.0_321||>= 1.8, < 1.8.0_311||>= 12, < 17.0.1||>= 7, < 7.0.321||>= 8, < 8.0.311||>= 9, < 11.0.13 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35586","fix":{"state":"fixed","versions":["1.7.0_321","7.0.321","1.8.0_311","8.0.311","11.0.13","17.0.1"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.7.0_321"},{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"17.0.1"},{"date":"2025-09-04","kind":"first-observed","version":"7.0.321"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"},{"date":"2025-09-04","kind":"first-observed","version":"11.0.13"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35586","date":"2026-11-02","epss":0.0679,"percentile":0.93998}],"risk":3.4629,"urls":["https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/","https://security.gentoo.org/glsa/202209-05","https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-5000","https://www.debian.org/security/2021/dsa-5012","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35586","description":"Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a6fcde16b943ffcb","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"risk":3.46,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"eca63cdd4d65e2ef","cpes":["cpe:2.3:a:libc-dev-bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev-bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev_bin:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc-dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc_dev:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-dev-bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_dev_bin:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc-dev-bin","purl":"pkg:deb/ubuntu/libc-dev-bin@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-dev-bin/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc-dev-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-dev-bin.list","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc-dev-bin.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"risk":3.46,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"a962637344871aaa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"risk":3.46,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"1a80ece3627ef154","cpes":["cpe:2.3:a:libc6-dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6-dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6_dev:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6-dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*","cpe:2.3:a:libc6:libc6_dev:2.19-0ubuntu6.13:*:*:*:*:*:*:*"],"name":"libc6-dev","purl":"pkg:deb/ubuntu/libc6-dev@2.19-0ubuntu6.13?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.13","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6-dev/copyright","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/usr/share/doc/libc6-dev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","layerID":"sha256:43cbabab0d4e8cebcacc5efba32ee7dc69a8ea5d5f71af326ca9648f69ee1a26","accessPath":"/var/lib/dpkg/info/libc6-dev:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.13"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"risk":3.46,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"556cca2eb09fbcff","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.11:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.11:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.11?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.11","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:554f627f09eecc516814f35de5c4fdffd76d4131017f93e445a893da3dfec86d","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.11"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"risk":3.46,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-11-02","epss":0.0692,"percentile":0.94104}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"83713ecc946a87aa","cpes":["cpe:2.3:a:libservlet2.5-java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5-java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5_java:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5-java:6.0.39-1:*:*:*:*:*:*:*","cpe:2.3:a:libservlet2.5:libservlet2.5_java:6.0.39-1:*:*:*:*:*:*:*"],"name":"libservlet2.5-java","purl":"pkg:deb/ubuntu/libservlet2.5-java@6.0.39-1?arch=all&distro=ubuntu-14.04&upstream=tomcat6","type":"deb","version":"6.0.39-1","language":"","licenses":["sha256:35b2672dd22812164ee23b744d72e9d82c82a1c72c762893978da7d4f7c34f65"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libservlet2.5-java/copyright","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/usr/share/doc/libservlet2.5-java/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libservlet2.5-java.list","layerID":"sha256:8b4e1b13493877aa0213bf5cba6a217e0d345b2b4e22b917c60ee0ec015024aa","accessPath":"/var/lib/dpkg/info/libservlet2.5-java.list"}],"upstreams":[{"name":"tomcat6"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.39-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-0096","versionConstraint":"< 6.0.39-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tomcat6","version":"6.0.39-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2014-0096","fix":{"state":"fixed","versions":["6.0.39-1ubuntu0.1"],"available":[{"date":"2014-05-31","kind":"advisory","version":"6.0.39-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0096","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0096","date":"2026-11-02","epss":0.06905,"percentile":0.94088}],"risk":3.4525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-0096"},"relatedVulnerabilities":[{"id":"CVE-2014-0096","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0096","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0096","date":"2026-11-02","epss":0.06905,"percentile":0.94088}],"urls":["http://advisories.mageia.org/MGASA-2014-0268.html","http://linux.oracle.com/errata/ELSA-2014-0865.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html","http://marc.info/?l=bugtraq&m=141017844705317&w=2","http://marc.info/?l=bugtraq&m=144498216801440&w=2","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://seclists.org/fulldisclosure/2014/Dec/23","http://seclists.org/fulldisclosure/2014/May/135","http://secunia.com/advisories/59121","http://secunia.com/advisories/59616","http://secunia.com/advisories/59678","http://secunia.com/advisories/59732","http://secunia.com/advisories/59835","http://secunia.com/advisories/59849","http://secunia.com/advisories/59873","http://secunia.com/advisories/60729","http://svn.apache.org/viewvc?view=revision&revision=1578610","http://svn.apache.org/viewvc?view=revision&revision=1578611","http://svn.apache.org/viewvc?view=revision&revision=1578637","http://svn.apache.org/viewvc?view=revision&revision=1578655","http://svn.apache.org/viewvc?view=revision&revision=1585853","http://tomcat.apache.org/security-6.html","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://www-01.ibm.com/support/docview.wss?uid=swg21678231","http://www-01.ibm.com/support/docview.wss?uid=swg21681528","http://www.debian.org/security/2016/dsa-3530","http://www.debian.org/security/2016/dsa-3552","http://www.mandriva.com/security/advisories?name=MDVSA-2015:052","http://www.mandriva.com/security/advisories?name=MDVSA-2015:053","http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","http://www.novell.com/support/kb/doc.php?id=7010166","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","http://www.securityfocus.com/archive/1/534161/100/0/threaded","http://www.securityfocus.com/bid/67667","http://www.securitytracker.com/id/1030301","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0096","description":"java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}]},{"artifact":{"id":"b92e7a35541b5777","cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*","cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"name":"jdk","purl":"pkg:generic/oracle/jdk@1.8.0_151","type":"binary","version":"1.8.0_151","language":"","licenses":[],"metadata":{"release":{"javaVersion":"1.8.0_151"}},"locations":[{"path":"/usr/lib/jvm/java-8-oracle/release","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/usr/lib/jvm/java-8-oracle/release"}],"upstreams":[],"metadataType":"JavaVMInstallationMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35560","versionConstraint":"< 1.8.0_311||>= 8, < 8.0.311 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:java_se:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35560","versionConstraint":"< 1.8.0_311||>= 8, < 8.0.311 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jdk:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}},{"fix":{"suggestedVersion":"1.8.0_311"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-35560","versionConstraint":"< 1.8.0_311||>= 8, < 8.0.311 (jvm)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:oracle:jre:1.8.0:update151:*:*:*:*:*:*"],"package":{"name":"jdk","version":"1.8.0_151"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-35560","fix":{"state":"fixed","versions":["1.8.0_311","8.0.311"],"available":[{"date":"2025-09-04","kind":"first-observed","version":"1.8.0_311"},{"date":"2025-09-04","kind":"first-observed","version":"8.0.311"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35560","date":"2026-11-02","epss":0.0483,"percentile":0.9199}],"risk":3.4292999999999996,"urls":["https://security.netapp.com/advisory/ntap-20211022-0004/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35560","description":"Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"relatedVulnerabilities":[]},{"artifact":{"id":"7a6e543b92a4ef77","cpes":["cpe:2.3:a:krb5-locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5-locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5_locales:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_locales:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"krb5-locales","purl":"pkg:deb/ubuntu/krb5-locales@1.12%2Bdfsg-2ubuntu5.3?arch=all&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/krb5-locales/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/krb5-locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/krb5-locales.list","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/krb5-locales.list"}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"risk":3.4290000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"7b0a3e6fba62d376","cpes":["cpe:2.3:a:libasn1-8-heimdal:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8-heimdal:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8_heimdal:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8_heimdal:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libasn1:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"libasn1-8-heimdal","purl":"pkg:deb/ubuntu/libasn1-8-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.2","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libasn1-8-heimdal/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libasn1-8-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasn1-8-heimdal:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libasn1-8-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"risk":3.4290000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"822a09707628283f","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.3?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.3","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"risk":3.4290000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"d2958d9da777fb9a","cpes":["cpe:2.3:a:libgssapi3-heimdal:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3-heimdal:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3_heimdal:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3_heimdal:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"libgssapi3-heimdal","purl":"pkg:deb/ubuntu/libgssapi3-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.2","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:32be5789369a90b961d88dd275eac0d82483741cc02498300d448198a19022c9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi3-heimdal/copyright","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/usr/share/doc/libgssapi3-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi3-heimdal:amd64.md5sums","layerID":"sha256:d07aaced374e83eeabf82513d036658f957a899b2fa957b4577f15b29f5fbff2","accessPath":"/var/lib/dpkg/info/libgssapi3-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"risk":3.4290000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-11-02","epss":0.06858,"percentile":0.94048}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]}],"grade":"F","score":"0.00","as_of":"2026-11-04T05:08:25.636Z","grype_db_version":"2026-11-03T06:20:47.000Z"}